# CVE-2025-71257: FootPrints - Authentication Bypass

> Live exploitation tracking for CVE-2025-71257 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-71257

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.9
- **Public exploit available:** Yes
- **Affected products:** BMC Software, Inc. FootPrints
- **Weaknesses:** CWE-306 (Missing Authentication for Critical Function)
- **Tags:** enterprise_software

## Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

## CrowdSec analysis

[CVE-2025-71257](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-71257) is an authentication bypass vulnerability in BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001, caused by improper enforcement of security filters on restricted REST API endpoints and servlets. This flaw allows unauthenticated remote attackers to bypass access controls, potentially granting them unauthorized access to sensitive application data and the ability to modify system resources. Attackers could exploit this vulnerability to compromise the integrity and confidentiality of the affected ITSM environment.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-71257 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-71257 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-71257 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the authentication bypass by sending unauthenticated requests to the `/footprints/servicedesk/passwordreset/request/` endpoint, allowing them to obtain a valid SEC_TOKEN session cookie without credentials.

## Timeline

- 2026-03-19: CVE Published. CVE-2025-71257 is published to NVD.
- 2026-04-01: Rule Released. CrowdSec releases a rule to detect CVE-2025-71257 exploitation attempts against the CrowdSec Network.
- 2026-04-01: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-71257 for the first time.

## References

- https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
- https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/
- https://www.vulncheck.com/advisories/bmc-footprints-itsm-authentication-bypass
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-71257.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-71257) follows observed exploitation activity for CVE-2025-71257. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.