Home / Vulnerability Intelligence / CVE-2025-71260

CVE-2025-71260 - Vulnerability Analysis

HighCVSS: 8.8

Last Updated: March 20, 2026

BMC FootPrints ITSM - Remote Code Execution

Published: March 19, 2026Updated: March 20, 2026Remote Exploitable

Overview

BMC FootPrints ITSM 20.20.02 through 20.24.01.001 contains an insecure deserialization vulnerability in ASP.NET servlet VIEWSTATE handling, letting authenticated attackers execute arbitrary code remotely, exploit requires authentication.

Severity & Score

Severity: High

CVSS Score: 8.8

EPSS Score: 915.2%(Probability of exploitation in next 30 days)

Impact

Authenticated attackers can execute arbitrary code remotely, fully compromising the application.

Mitigation

Apply hotfixes 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01.

References

Social Media Activity(1 post)

ZEN SecDB

@secdb

Apr 1, 2026

📈 CVE Published in last 30 days (2026-03-02 - 2026-04-01) See more at https://secdb.nttzen.cloud/dashboard Total CVEs: 6145 Severity: - Critical: 615 - High: 2408 - Medium: 2575 - Low: 237 - None: 310 Status: - : 52 - Analyzed: 2872 - Awaiting Analysis: 2622 - Modified: 245 - Received: 185 - Rejected: 58 - Undergoing Analysis: 111 Top CNAs: - GitHub, Inc.: 1471 - Patchstack: 699 - VulnCheck: 594 - VulDB: 577 - MITRE: 381 - Wordfence: 308 - kernel.org: 180 - Microsoft Corporation: 97 - Apple Inc.: 89 - Adobe Systems Incorporated: 86 Top Affected Products: - UNKNOWN: 3040 - Openclaw: 173 - Google Android: 101 - Apple Macos: 79 - Google Chrome: 75 - Wwbn Avideo: 65 - Parseplatform Parse-server: 56 - Mozilla Firefox: 48 - Apple Ipados: 44 - Open-emr Openemr: 44 Top EPSS Score: - CVE-2025-14558 - 53.60 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-14558) - CVE-2026-29058 - 42.99 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-29058) - CVE-2026-1492 - 29.00 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-1492) - CVE-2026-2025 - 26.43 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2025) - CVE-2026-2413 - 26.22 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2413) - CVE-2026-27971 - 23.12 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-27971) - CVE-2023-7337 - 22.17 % (https://secdb.nttzen.cloud/cve/detail/CVE-2023-7337) - CVE-2026-33634 - 20.84 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-33634) - CVE-2026-2493 - 15.24 % (https://secdb.nttzen.cloud/cve/detail/CVE-2026-2493) - CVE-2025-71260 - 9.15 % (https://secdb.nttzen.cloud/cve/detail/CVE-2025-71260)

View original post

GitHub Repositories(1 repo)

https://github.com/watchtowrlabs/watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260

Related Resources

Details

CVE ID: CVE-2025-71260
Severity: High
CVSS Score: 8.8
Type: insecure_deserialization
Status: unconfirmed
EPSS: 915.2%
Nuclei: Available
Social Posts: 1

CWE

CWE-502

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

915.2%Probability of exploitation in the next 30 days

Nuclei Template

View Nuclei Template