PT-2026-26063 · Bmc · Bmc Footprints Itsm

Sonny

·

Published

2026-03-18

·

Updated

2026-03-23

·

CVE-2025-71260

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001
Description BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 are affected by a deserialization of untrusted data issue in the ASP.NET servlet's VIEWSTATE handling. Authenticated attackers can exploit this to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and potentially compromise the application. The vulnerability resides in the handling of the VIEWSTATE parameter within the ASP.NET servlet.
Recommendations Apply hotfix 20.20.02. Apply hotfix 20.20.03.002. Apply hotfix 20.21.01.001. Apply hotfix 20.21.02.002. Apply hotfix 20.22.01. Apply hotfix 20.22.01.001. Apply hotfix 20.23.01. Apply hotfix 20.23.01.002. Apply hotfix 20.24.01.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-71260

Affected Products

Bmc Footprints Itsm