CVE-2025-71260
High
Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
SeverityHigh
CVSS8.8
Exploit probability—
ProductBmc Footprints
PublishedMar 19, 2026
First seenMar 19, 2026
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bmc footprints | 20.20.02 ≤ v ≤ 20.24.01.001 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.