The vulnerability CVE-2026-10540 involves the use of weak cryptographic hash functions for storing password hashes in BMC Control-M/Enterprise Manager, specifically version 9.0.20 and potentially earlier unsupported versions. This weakness in hash protection could enable attackers who obtain credential data to recover passwords offline. The CVSS 4.0 base score is 5.6 (medium severity), reflecting that exploitation requires local access with high privileges and partial attack complexity. No official remediation or patch is currently documented.

An attacker who gains access to stored credential hashes on affected versions could potentially recover passwords offline due to weak hash protections. This could lead to unauthorized access if the recovered credentials are reused or provide further attack vectors. However, exploitation requires local access with high privileges, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected versions are unsupported and no official fix or temporary mitigation is documented, users should consider upgrading to a supported version with improved hash protections or implement compensating controls to protect credential storage and limit access to sensitive data.