What’s Vulnerable › Vulnerabilities

CVE-2025-71260: BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 34.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-19 · updated 2026-08-06
• Weakness: CWE-502

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Affected products

• BMC Software, Inc. FootPrints: from 20.20.02 through 20.24.01.001

References

• https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/
• https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
• https://www.vulncheck.com/advisories/bmc-footprints-itsm-viewstate-deserialization-rce

Get alerted when CVE-2025-71260 or the next vulnerability affects your stack