CVE-2025-71257 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass
Unauthenticated attackers can bypass access controls on REST APIs to read data and modify system resources in BMC FootPrints ITSM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-71257?
CVE-2025-71257 is a medium-severity authentication bypass vulnerability in BMC Software, Inc. FootPrints, published on 19 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Weakness: CWE-306
Which versions are affected by CVE-2025-71257?
It affects 1 product.
Products include Bmc Footprints.
How do I fix CVE-2025-71257?
No fix has been published for CVE-2025-71257 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-71257 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-71257 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in BMC Software, Inc. FootPrints
Sources
Also known as GHSA-5pjp-c363-m6g8.