What is CVE-2026-23782?

CVE-2026-23782 is a high-severity vulnerability in Bmc Control-M\/managed File Transfer, classified under Improper Access Control. CVSS score: 7.5/10. Published 2026-04-10.

How severe is CVE-2026-23782?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Bmc Control-M\/managed File Transfer

CVE-2026-23782

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With these exposed secrets, an attacker could invoke privileged API operations, potentially leading to unauthorized access.

EPSS: 0.003 (19.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Bmc Control-m\/managed_file_transfer
N/a — versions n/a

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

cve@mitre.org (Vendor Advisory)
cve@mitre.org (Patch)

Frequently asked questions

What is CVE-2026-23782?: CVE-2026-23782 is a high-severity vulnerability in Bmc Control-M\/managed File Transfer, classified under Improper Access Control. CVSS score: 7.5/10. Published 2026-04-10.
How severe is CVE-2026-23782?: High severity. CVSS v3 base score is 7.5 out of 10.