FootPrints - Authentication Bypass (CVE-2025-71257)

CVE-2025-71257 is an authentication bypass vulnerability in BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001, caused by improper enforcement of security filters on restricted REST API endpoints and servlets. This flaw allows unauthenticated remote attackers to bypass access controls, potentially granting them unauthorized access to sensitive application data and the ability to modify system resources. Attackers could exploit this vulnerability to compromise the integrity and confidentiality of the affected ITSM environment.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-71257 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-71257 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-71257 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the authentication bypass by sending unauthenticated requests to the /footprints/servicedesk/passwordreset/request/ endpoint, allowing them to obtain a valid SEC_TOKEN session cookie without credentials.