CVE-2026-23780

CVE-2026-23780 is a SQL injection vulnerability affecting BMC Control-M/MFT versions 9.0.20 through 9.0.22 in the MFT API's debug interface. The flaw stems from improper input validation and unsafe dynamic SQL handling that allows authenticated attackers to inject malicious queries. Successful exploitation could enable arbitrary file read/write operations and potentially result in remote code execution. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector, low complexity, and low privilege requirements. The attack requires user interaction only for authentication, meaning an authenticated attacker can exploit it remotely without additional user involvement. The impact is severe, affecting confidentiality, integrity, and availability of affected systems. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on threat tracking lists. The EPSS score of 0.00186 indicates relatively low probability of exploitation compared to other CVEs. Organizations should nevertheless prioritize patching affected versions to eliminate the risk of SQL injection-based data exfiltration and potential code execution before threat actors develop reliable exploits.