CVE-2025-55115
High
Description
A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions. This vulnerability was fixed in 9.0.20.100 and above.
SeverityHigh
CVSS8.8
Exploit probability—
ProductBmc Control-m\/agent
PublishedSep 16, 2025
First seenSep 16, 2025
Weakness typeCWE-23CWE-23
How to fix
Update
- bmc control-m\/agent9.0.20.100 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bmc control-m\/agent | v < 9.0.20.100 | 9.0.20.100 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.