# CVE-2025-71260: BMC FootPrints ITSM deserialization of untrusted data in VIEWSTATE

Source: https://junglewise.ai/threats/cve-2025-71260-bmc-footprints-itsm-deserialization-of-untrusted-data-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-71260 · Severity: high · CVSS 8.8 · Published 2026-03-19

BMC FootPrints is an IT Service Management platform used to manage service requests, incidents, and assets. A flaw in how the application deserializes untrusted data in the VIEWSTATE parameter allows authenticated attackers to execute arbitrary code on the server, fully compromising the application and potentially enabling access to sensitive IT inventory and configuration data stored within.

Technologies: [Bmc Footprints](https://junglewise.ai/threats/technologies/footprints), [Bmc FootPrints ITSM](https://junglewise.ai/threats/technologies/footprints-itsm). Vendors: [Bmc](https://junglewise.ai/threats/vendors/bmc).

## Quick answers

**Is CVE-2025-71260 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-71260 being exploited in the wild.

**How severe is CVE-2025-71260?** High severity, with a CVSS score of 8.8, published 19 March 2026.

**Which products and versions are affected?** Bmc FootPrints ITSM 20.20.02 through 20.24.01.001.

**Is there a fix for CVE-2025-71260?** A patch was published on 2025-09-02: BMC released hotfixes for all affected versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-71260 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-71260?** Check whether you run Bmc Footprints or Bmc FootPrints ITSM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the ASP.NET servlet's VIEWSTATE handling within BMC FootPrints versions 20.20.02 through 20.24.01.001. An authenticated attacker can supply crafted serialized objects (via the AspectJWeaver gadget chain or similar deserialization gadgets) to the VIEWSTATE parameter to trigger unsafe deserialization, leading to remote code execution. The attack requires authentication but allows complete application compromise. BMC released hotfixes in September 2025 for all affected versions (20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01). This vulnerability is part of a chain with authentication bypass (CVE-2025-71257) discovered by watchTowr Labs.

## Affected products

- BMC FootPrints ITSM 20.20.02 through 20.24.01.001

## Timeline

- 2025-06-06: disclosed: watchTowr Labs disclosed CVE-2025-71260 (WT-2025-0072) to BMC
- 2025-09-02: patched: BMC released hotfixes for all affected versions
- 2026-03-02: advisory: CVE-2025-71260 assigned
- 2026-03-18: other: watchTowr Labs published detailed research

## References

- [https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/](https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/)
- [https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/](https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/)

## Related threats

- [BMC FootPrints ITSM server-side request forgery in externalfeed/RSS](https://junglewise.ai/threats/cve-2025-71259-bmc-footprints-itsm-server-side-request-forgery-in-externalfeed)
- [BMC FootPrints ITSM blind server-side request forgery in searchWeb API](https://junglewise.ai/threats/cve-2025-71258-bmc-footprints-itsm-blind-server-side-request-forgery-in)
- [BMC FootPrints ITSM authentication bypass in REST API](https://junglewise.ai/threats/cve-2025-71257-bmc-footprints-itsm-authentication-bypass-in-rest-api)