1. Home
  2. CVE Database
  3. CVE-2026-23781
CRITICAL · 9.8

CVE-2026-23781

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentia...

Vulnerability Description

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentials can be easily obtained and may allow unauthorized access to the MFT API debug interface.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
BmcControl-M\/Managed File Transfer>= 9.0.20, <= 9.0.22

Related Weaknesses (CWE)

CWE-798

References

FAQ

What is CVE-2026-23781?

CVE-2026-23781 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credentia...

How severe is CVE-2026-23781?

CVE-2026-23781 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-23781?

Check the references section above for vendor advisories and patch information. Affected products include: Bmc Control-M\/Managed File Transfer.