Vulnerability · Published Mar 19, 2026 · Assigned by VulnCheck
CVE-2025-71260BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE
High 8.8
In plain English
A high-severity unsafe deserialization in FootPrints from BMC Software, Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 34.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BMC Software, Inc. | FootPrints | 20.20.02 – through 20.24.01.001 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/ patch
- https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/ technical-description, exploit
- https://www.vulncheck.com/advisories/bmc-footprints-itsm-viewstate-deserialization-rce third-party-advisory