CVE-2025-55113 BMC Control-M/Agent unescaped NULL byte in access control list checks

What is CVE-2025-55113?

CVE-2025-55113 is a critical authentication bypass vulnerability in BMC Control-M/Agent, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a specially crafted certificate.

Weakness: CWE-158

Which versions are affected by CVE-2025-55113?

It affects 1 product.

Products include Bmc Control-M\/Agent.

How do I fix CVE-2025-55113?

No fix has been published for CVE-2025-55113 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-55113 being exploited?

There is no known exploitation of CVE-2025-55113 in the wild and no public exploit code.

Other vulnerabilities in BMC Control-M/Agent

• CVE-2025-55109 BMC Control-M/Agent default SSL/TLS configuration authenticated bypass Critical 9.5
• CVE-2025-55115 BMC Control-M/Agent path traversal local privilege escalation Critical 9.3
• CVE-2025-55116 BMC Control-M/Agent buffer overflow local privilege escalation Critical 9.3
• CVE-2025-55112 BMC Control-M/Agent hardcoded Blowfish keys High 7.6
• CVE-2025-55117 BMC Control-M/Agent buffer overflow in SSL/TLS communication Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r6f6-cvqf-h86g.