CVE-2025-71260 BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE
Authenticated attackers can execute arbitrary code via crafted VIEWSTATE parameters in BMC FootPrints ITSM, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-71260?
CVE-2025-71260 is a high-severity unsafe deserialization vulnerability in BMC Software, Inc. FootPrints, published on 19 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Weakness: CWE-502
Which versions are affected by CVE-2025-71260?
It affects 1 product.
Products include Bmc Footprints.
How do I fix CVE-2025-71260?
No fix has been published for CVE-2025-71260 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-71260 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-71260 exists.
Other vulnerabilities in BMC Software, Inc. FootPrints
Sources
Also known as GHSA-x6vr-xp32-5v9x.