CVE-2025-55113 CRITICAL

CVE-2025-55113: BMC Control-M/Agent unescaped NULL byte in access control list checks

Vendor Bmc
Product Control-M/Agent
Weakness CWE-158
Published September 16, 2025
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

9.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a specially crafted certificate.

Key dates

02Disclosure timeline

September 16, 2025 CVE published
February 26, 2026 Record updated