An authentication bypass vulnerability in older BMC Control-M/Agent versions allows attackers to gain unauthorized access due to flawed certificate validation.

This is an improper certificate validation flaw (CWE-295) that allows an authentication bypass. The vulnerability is triggered when the agent is configured with an empty or default kdb keystore, permitting unauthorized access over the network.

With a CVSS score of 9.0, this vulnerability poses a severe risk to organizational infrastructure. An authentication bypass on a management agent like Control-M can allow an attacker to gain unauthorized control over job scheduling and execution, leading to potential data manipulation, unauthorized code execution, and widespread disruption of automated business processes.

Immediate Action: Upgrade all instances of BMC Control-M/Agent to version 9.0.21 or later, as these versions are unaffected by the certificate validation flaw.

Proactive Monitoring: Audit existing Control-M/Agent installations to identify any servers still running versions 9.0.20 or older. Review logs for unauthorized connection attempts originating from untrusted hosts.

Compensating Controls: Ensure that all communication to and from the Control-M/Agent is restricted via network firewalls and that mutual TLS (mTLS) is strictly enforced with custom, non-default certificates.

Public Exploit Available: No (exploit_available: unknown)

Organizations should treat this as a high-priority update. Because these versions of the Control-M/Agent are out-of-support, transitioning to version 9.0.21 or newer is the only reliable method to eliminate the risk of authentication bypass and ensure the integrity of the automation environment.