PatchTheCVECVE-2025-55111: Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent version
CVE-2025-55111 is a medium-severity flaw (CVSS 5.5) affecting control-m\/agent. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating to SSL files, keystore and policies. An attacker with local access to the system running the Agent can access these files.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-276 |
| Published | 2025-09-16 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-55111?
control-m\/agent: upgrade to 9.0.21. Exact commands for each OS are on this page.
Is CVE-2025-55111 being exploited?
CVE-2025-55111 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-55111 affect?
CVE-2025-55111 affects control-m\/agent. Severity is medium (CVSS 5.5). Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected
How urgent is CVE-2025-55111?
Priority 20/100. No elevated risk signals yet.
Related CVEs
- CVE-2025-55117 MEDIUM 5.3 UPGRADE A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agen
- CVE-2025-55116 HIGH 8.8 UPGRADE A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access
- CVE-2025-55115 HIGH 8.8 UPGRADE A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access t
- CVE-2025-55113 CRITICAL 9.0 UPGRADE If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-su
- CVE-2025-55112 HIGH 7.4 UPGRADE Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that a