CVE-2026-23781

The BMC Control-M/MFT software (versions 9.0.20 through 9.0.22 ) is vulnerable to unauthorized access due to hardcoded default debug user credentials stored in cleartext within the application package. If these credentials remain unchanged, an attacker can easily obtain them to access the MFT API...

FTAPI Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in FTAPI 4.0 - 4.10, which allows the passage of a crafted filename to an alternate text hover box in the file submission component...