External risk intelligence

Control-M Agent Unauthenticated Remote Code Execution When SSL/TLS Mutual Authentication Is Not Enabled.

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2025-55108

Control-M/Agent is an internal infrastructure component designed for communication between a central server and managed hosts within a private environment. While network-reachable in typical deployments, it is not designed to be exposed to the public internet, and such exposure would be contrary to standard security deployment practices.

Missing Authentication

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The Control-M/Agent has a vulnerability that could allow unauthorized remote code execution and file access if specific security configurations are not in place. The vendor notes this typically occurs when documented best practices, such as enabling SSL/TLS for secure communication, are not followed. Control-M SaaS environments are not affected.

Unauthenticated remote control and data access risk.
Best practices mitigate this specific exposure.
Confirm Control-M Agent security settings.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable Control-M/Agent component over the network without needing authentication if mutual SSL/TLS is not configured. This exposure allows the attacker to interact with the agent, potentially leading to unauthorized actions.

Network exposure without authentication required.
Default configuration triggers vulnerability.
Remote code execution and data access.

Live Threat

Current exploitation, exposure, and threat context

When mutual SSL/TLS authentication is not enabled, an attacker could execute arbitrary code, read or write files, and perform other unauthorized actions on the Control-M/Agent. This scenario is supported when the default configuration is used and documented security best practices are not followed. The Control-M SaaS offering is not impacted.

System data and service behavior.
Network access to unauthenticated agent.
Unauthorized actions and code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Control-M/Agent likely falls under the responsibility of infrastructure or platform teams managing the Control-M environment, in coordination with security and vendor management teams. The immediate first step is to identify all Control-M/Agent instances, determine their network reachability and criticality, and locate the accountable owner for each. Remediation planning should then be risk-based, considering factors like SSL/TLS configuration and vendor guidance.

Identify Control-M/Agent instances and ownership.
Verify SSL/TLS configuration and network exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Control-M/Agent and how is it used?

Control-M/Agent is a software component within the Control-M workload automation suite. Its primary role is to execute jobs, manage tasks, and report status back to a central Control-M Server across an organization's IT infrastructure. It functions as a bridge that allows the central server to interact with and control various local or remote hosts where business processes and automated workflows are processed.

How does CVE-2025-55108 work?

This vulnerability involves a missing authentication weakness, identified as CWE-306. Because the agent fails to require mutual SSL/TLS authentication by default, it may accept unauthorized commands from remote network sources. This weakness allows an attacker to bypass standard identity checks, leading to critical impacts like remote code execution or unauthorized file manipulation on the affected host.

Does this vulnerability always trigger?

No. The vulnerability is tied to the communication configuration between the Control-M Server and the Agent. It occurs primarily when mutual SSL/TLS authentication is disabled, which is the default state in some deployments. If an administrator has explicitly configured and enabled mutual SSL/TLS for communication, the specific conditions required to trigger this unauthorized access are not met.

Is my organization at risk from this vulnerability?

According to the Halo Surface Signal, this component is intended for private environments and is typically not meant for public internet exposure. While it is classified as external because it can be reached over a network, an organization is most at risk if these agents are incorrectly placed on public-facing networks rather than being restricted to internal, private infrastructure segments.

How do I start securing my Control-M/Agent instances?

Your first step is to inventory all active Control-M/Agent instances and confirm who is responsible for their maintenance. Once identified, verify whether mutual SSL/TLS authentication is enabled on each agent. If it is not, review the vendor’s documented security best practices to enable this configuration, which is the primary method to mitigate the risk of unauthorized access.

References

bmcapps.my.site.com/casemgmt/sc_KnowledgeArticle?sfdcid=000442099

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.