# CVE-2025-71259: BMC FootPrints ITSM server-side request forgery in externalfeed/RSS

Source: https://junglewise.ai/threats/cve-2025-71259-bmc-footprints-itsm-server-side-request-forgery-in-externalfeed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-71259 · Severity: medium · CVSS 4.3 · Published 2026-03-19

BMC FootPrints is an IT Service Management platform used by organizations to manage service requests, incidents, and IT assets. A blind server-side request forgery vulnerability in the RSS feed component allows authenticated users to trigger arbitrary outbound network requests from the server, potentially exposing internal services or causing service disruption through resource exhaustion.

Technologies: [Bmc Footprints](https://junglewise.ai/threats/technologies/footprints), [Bmc FootPrints ITSM](https://junglewise.ai/threats/technologies/footprints-itsm). Vendors: [Bmc](https://junglewise.ai/threats/vendors/bmc).

## Quick answers

**Is CVE-2025-71259 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71259 being exploited in the wild.

**How severe is CVE-2025-71259?** Medium severity, with a CVSS score of 4.3, published 19 March 2026.

**Which products and versions are affected?** Bmc FootPrints ITSM 20.20.02 through 20.24.01.001.

**Is there a fix for CVE-2025-71259?** A patch was published on 2025-09-02: BMC releases hotfixes for versions 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71259 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-71259?** Check whether you run Bmc Footprints or Bmc FootPrints ITSM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a blind server-side request forgery (SSRF) vulnerability in the externalfeed/RSS API component of BMC FootPrints ITSM. The vulnerability stems from insufficient validation of externally supplied resource references, allowing authenticated attackers to craft requests that force the server to make arbitrary outbound HTTP requests. An attacker with valid credentials can exploit this to interact with internal services, bypass firewalls, or trigger denial-of-service conditions through resource exhaustion. The vulnerability affects versions 20.20.02 through 20.24.01.001, and patches have been released for affected versions.

## Affected products

- BMC FootPrints ITSM 20.20.02 through 20.24.01.001

## Timeline

- 2026-03-18: disclosed: watchTowr publishes research on CVE-2025-71259 and related vulnerabilities
- 2025-09-02: patched: BMC releases hotfixes for versions 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01
- 2026-03-02: advisory: CVE-2025-71259 assigned by NVD

## References

- [https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/](https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/)
- [https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/](https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/)

## Related threats

- [BMC FootPrints ITSM deserialization of untrusted data in VIEWSTATE](https://junglewise.ai/threats/cve-2025-71260-bmc-footprints-itsm-deserialization-of-untrusted-data-in)
- [BMC FootPrints ITSM blind server-side request forgery in searchWeb API](https://junglewise.ai/threats/cve-2025-71258-bmc-footprints-itsm-blind-server-side-request-forgery-in)
- [BMC FootPrints ITSM authentication bypass in REST API](https://junglewise.ai/threats/cve-2025-71257-bmc-footprints-itsm-authentication-bypass-in-rest-api)