CVE-2025-71257

CVE Enrichment

CVSS: 6.9 MEDIUM
EPSS: 45.30%
EPSS Percentile: 98.79%
CISA KEV: Not listed

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 19-Mar-2026 21:16
Last Modified: 06-Aug-2026 22:21
EPSS Date: 2026-11-07
CWE: CWE-306

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:L /
                            VI:L /
                            VA:L /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

BMC Software, Inc. · FootPrints Source: CNA · [email protected]
Default status: unaffected

20.20.02 ≤ version ≤ 20.24.01.001 — affected (custom)

Affected Products / Versions

bmc / footprints Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.20.02 · through (inclusive) 20.24.01.001
cpe:2.3:a:bmc:footprints:*:*:*:*:*:*:*:*

References

Last enrichment sync: 08-Nov-2026 17:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

BMC FootPrints contains a preâauth RCE chain (CVE-2025-71257–71260) that leverages an extracted SEC_TOKEN and Java deserialization to write files to Tomcat. ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploitation and MCP Abuse

CVE (6)

Malware (5)

People (1)

Threat Actors (6)

MITRE ATT&CK (7)

Vendors (3)

Products (10)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.