CVE-2026-23782

An improper access control vulnerability exists in BMC Control-M/MFT versions 9.0.20 through 9.0.22 . A flaw in an API management endpoint allows unauthenticated users to retrieve both an API identifier and its associated secret value. An attacker can leverage these exposed secrets to execute pri...