PatchTheCVECVE-2025-55113: If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-su
CVE-2025-55113 is a critical-severity flaw (CVSS 9.0) affecting control-m\/agent. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stops at the first NULL byte encountered in the email address referenced in the client certificate. An attacker could bypass configured ACLs by using a sp
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.0 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 78%) |
| CISA exploited list | No |
| Weakness | CWE-158 |
| Published | 2025-09-16 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-55113?
control-m\/agent: upgrade to newer than 9.0.22. Exact commands for each OS are on this page.
Is CVE-2025-55113 being exploited?
CVE-2025-55113 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-55113 affect?
CVE-2025-55113 affects control-m\/agent. Severity is critical (CVSS 9.0). If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using t
How urgent is CVE-2025-55113?
Priority 42/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2025-55117 MEDIUM 5.3 UPGRADE A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agen
- CVE-2025-55116 HIGH 8.8 UPGRADE A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access
- CVE-2025-55115 HIGH 8.8 UPGRADE A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access t
- CVE-2025-55112 HIGH 7.4 UPGRADE Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that a
- CVE-2025-55111 MEDIUM 5.5 UPGRADE Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent version