Authentication Bypass Vulnerability in BMC FootPrints ITSM
CVE-2025-71257

6.9MEDIUM

Key Information:

Vendor

Bmc Software, Inc.

Status
Footprints
Vendor
CVE Published:
19 March 2026

Badges

👾 Exploit Exists

What is CVE-2025-71257?

BMC FootPrints ITSM contains an authentication bypass vulnerability due to inadequate security filters on restricted REST API endpoints and servlets. This allows unauthenticated remote attackers to circumvent access controls, enabling them to exploit restricted functionalities, access confidential application data, and potentially alter system resources. To mitigate this vulnerability, users are encouraged to apply the relevant hotfixes available for affected versions.

Affected Version(s)

FootPrints 20.20.02 <= 20.24.01.001

References

https://docs.bmc.com/xwiki/bin/view/More-Products/Footpri...
patch
https://labs.watchtowr.com/thanks-itsms-threat-actors-hav...
technical-descriptionexploit
https://www.vulncheck.com/advisories/bmc-footprints-itsm-...
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sonny of watchTowr
.