CVE-2025-71260

CVE Enrichment

CVSS: 8.7 HIGH
EPSS: 34.36%
EPSS Percentile: 98.42%
CISA KEV: Not listed

Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 19-Mar-2026 21:16
Last Modified: 06-Aug-2026 22:21
EPSS Date: 2026-11-07
CWE: CWE-502

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

BMC Software, Inc. · FootPrints Source: CNA · [email protected]
Default status: unaffected

20.20.02 ≤ version ≤ 20.24.01.001 — affected (custom)

Affected Products / Versions

bmc / footprints Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 20.20.02 · through (inclusive) 20.24.01.001
cpe:2.3:a:bmc:footprints:*:*:*:*:*:*:*:*

References

Last enrichment sync: 08-Nov-2026 17:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Four security flaws (CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, and CVE-2025-71260) have been disclosed in BMC FootPrints, a widely deployed ITSM solution, that could be chained into pre-authentication remote code ThreatsDay Bulletin: FortiGate RaaS, Citrix Exploitation and MCP Abuse

CVE (6)

Malware (5)

People (1)

Threat Actors (6)

MITRE ATT&CK (7)

Vendors (3)

Products (10)

Industries (1)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.