CVE-2026-10540

MediumCVSS 5.6/10Last modified Oct 25, 2026

Description

The Control-M/Enterprise Manager uses weak protections for stored hashes of account passwords, potentially allowing offline password recovery attacks if credential data is obtained by an attacker. This vulnerability affects Control-M/Enterprise Manager unsupported versions 9.0.20.x and potentially earlier unsupported versions

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-328

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jul 1, 2026
Last modified: Oct 25, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1054078.8An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrar CVE-2026-1054088.7A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec CVE-2026-1054098.7A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec CVE-2026-1054108.7A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec CVE-2026-1054118.1An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an CVE-2026-1054127.1An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database.CVE-2026-1054137.5The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on i CVE-2026-105424.3Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership whic CVE-2026-1054209.4Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the add CVE-2026-1054215.3Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectl CVE-2026-1054226.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Researc CVE-2026-1054257.2OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.