PT-2026-26063 · Bmc · Bmc Footprints Itsm

Sonny

·

Published

2026-03-18

·

Updated

2026-04-27

·

CVE-2025-71260

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001
Description An issue exists in the ASP.NET servlet's VIEWSTATE handling involving the deserialization of untrusted data. Authenticated attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application.
Recommendations Apply hotfix 20.20.02 for version 20.20.02. Apply hotfix 20.20.03.002 for version 20.20.03. Apply hotfix 20.21.01.001 for version 20.21.01. Apply hotfix 20.21.02.002 for version 20.21.02. Apply hotfix 20.22.01 for version 20.22.01. Apply hotfix 20.22.01.001 for version 20.22.01.001. Apply hotfix 20.23.01 for version 20.23.01. Apply hotfix 20.23.01.002 for version 20.23.01.002. Apply hotfix 20.24.01 for version 20.24.01.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-71260

Affected Products

Bmc Footprints Itsm