PatchTheCVE: control-m\/agenthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-55117: A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agenhttps://patchthecve.com/cve/CVE-2025-55117.htmlhttps://patchthecve.com/cve/CVE-2025-55117.htmlWed, 17 Jun 2026 09:41:18 +0000MEDIUM 5.3: A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configuration is set to the non-default setting "use_openssl=n"; CVE-2025-55116: A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access https://patchthecve.com/cve/CVE-2025-55116.htmlhttps://patchthecve.com/cve/CVE-2025-55116.htmlWed, 17 Jun 2026 09:41:17 +0000HIGH 8.8: A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions.CVE-2025-55115: A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access thttps://patchthecve.com/cve/CVE-2025-55115.htmlhttps://patchthecve.com/cve/CVE-2025-55115.htmlWed, 17 Jun 2026 09:41:17 +0000HIGH 8.8: A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions. This vulnerability was fCVE-2025-55113: If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-suhttps://patchthecve.com/cve/CVE-2025-55113.htmlhttps://patchthecve.com/cve/CVE-2025-55113.htmlWed, 17 Jun 2026 09:41:17 +0000CRITICAL 9.0: If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions; non-default but configurable using the JAVA_AR setting in newer versions), the verification stopCVE-2025-55112: Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that ahttps://patchthecve.com/cve/CVE-2025-55112.htmlhttps://patchthecve.com/cve/CVE-2025-55112.htmlWed, 17 Jun 2026 09:41:17 +0000HIGH 7.4: Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key. An attacker with access to network traffic and to this key could decrypt network traffic between theCVE-2025-55111: Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versionhttps://patchthecve.com/cve/CVE-2025-55111.htmlhttps://patchthecve.com/cve/CVE-2025-55111.htmlWed, 17 Jun 2026 09:41:17 +0000MEDIUM 5.5: Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating to CVE-2025-55109: An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 https://patchthecve.com/cve/CVE-2025-55109.htmlhttps://patchthecve.com/cve/CVE-2025-55109.htmlWed, 17 Jun 2026 09:41:17 +0000CRITICAL 9.0: An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS#12 keystore. A remote attacker with access to a signed third-party or demo certific