External risk intelligence

BMC Control-M/MFT Hardcoded Debug Credentials Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-23781

BMC Control-M/MFT is a managed file transfer solution designed to facilitate data exchange, which is commonly deployed as an internet-facing or edge-accessible service to support external file transfers. The exposure of an API interface in this product creates a network-accessible surface that is typically intended to be reachable to facilitate integration and file movement workflows.

Bmc Control M\/managed File Transfer

9.0.20 to 9.0.22

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue has been identified in BMC Control-M/MFT related to hardcoded default credentials. This vulnerability, if unaddressed, could allow unauthorized access to the MFT API debug interface through easily discoverable credentials. The primary concern is to confirm if our environment utilizes the affected product and versions.

Default credentials can expose debug interfaces.
Easy access to sensitive transfer functions.
Confirm product usage and default credential status.

Attack Path

How an attacker could exploit the issue

An attacker could gain access to the MFT API debug interface by leveraging hardcoded default credentials present in the application package. If these credentials are not changed after installation, an attacker on the network could potentially discover and use them to access the debug interface, leading to unauthorized actions. The specific steps an attacker would take to discover or utilize these credentials beyond their initial retrieval are not detailed.

Default debug credentials are hardcoded.
Unauthorized access to MFT API debug interface.
Risk of unauthorized actions via debug interface.

Live Threat

Current exploitation, exposure, and threat context

When default debug user credentials are not changed, unauthorized access to the MFT API debug interface could occur. This interface is accessible over the network.

MFT API debug interface access.
Default hardcoded credentials exposed.
Unauthorized system access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that BMC Control-M/MFT handles sensitive file transfers, the primary responsibility for addressing this vulnerability likely falls to the Platform or Infrastructure teams that manage this solution, in coordination with the Application owners who rely on its functionality and potentially Vendor Management if a patch or update is required from BMC. The first practical step is to identify all instances of the affected Control-M/MFT, confirm their network exposure and business criticality, and then determine the appropriate remediation or risk reduction strategy.

Platform and application owners should act.
Verify network reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is BMC Control-M/MFT?

BMC Control-M/MFT is a specialized software solution designed for managed file transfer. It automates and secures the movement of data across enterprise environments, allowing organizations to reliably exchange files between internal systems, partners, and cloud services.

What does CWE-798 mean for CVE-2026-23781?

CWE-798 refers to the use of hardcoded credentials. In the context of CVE-2026-23781, it means the software contains a built-in, unchangeable username and password for the debug interface. Because these credentials are embedded in the application's code, they are predictable and can be used to bypass authentication.

How can an attacker trigger this vulnerability?

An attacker can trigger this by using the known, hardcoded credentials to connect to the MFT API debug interface over the network. It is important to note that simply having the software installed does not trigger the bug; it specifically requires that the default, hardcoded credentials remain active and unchanged within the application.

Why is this a concern if my instance is not internet-facing?

According to Halo Surface Signal, BMC Control-M/MFT is often deployed as an edge-accessible service to facilitate external data movement. While internet-facing instances are at the highest risk, any system reachable on your internal network could be compromised by an attacker who has already gained a foothold elsewhere in your environment.

What should I do if I run this technology?

Your first step is to perform an inventory to locate all instances of BMC Control-M/MFT versions 9.0.20 through 9.0.22. Once identified, coordinate with your infrastructure and application teams to verify the status of these default credentials. Prioritize securing or disabling the affected debug interface and consult BMC support resources for official patches.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.