A Control-M/Server communication command does not sufficiently filter or sanitize user-supplied input. Under certain conditions, this issue may allow an unauthe…

A vulnerability in BMC Control-M/Server allows unauthenticated attackers to execute unauthorized commands due to insufficient input filtering or sanitization in a communication command. The flaw exists in versions 9.0.20.x through 9.0.21.200 and potentially earlier unsupported versions. Successful exploitation could lead to full server compromise. No authentication is required to exploit this vulnerability, significantly raising its severity. The vulnerability was published via NVD and BMC has issued a knowledge article with remediation guidance.