# CVE-2025-71260: FootPrints - RCE

> Live exploitation tracking for CVE-2025-71260 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-71260

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 8.7
- **Public exploit available:** Yes
- **Affected products:** BMC Software, Inc. FootPrints
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)
- **Tags:** enterprise_software, web_application

## Description

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

## CrowdSec analysis

[CVE-2025-71260](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-71260) is a high-severity vulnerability in BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001, where improper handling of VIEWSTATE deserialization in the ASP.NET servlet allows authenticated attackers to execute arbitrary code. By sending specially crafted serialized objects to the VIEWSTATE parameter, attackers can achieve remote code execution and potentially gain full control over the affected application. This flaw poses a significant risk of system compromise and data breach within vulnerable environments.

CrowdSec has been tracking this vulnerability and its exploits since 1st of April 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-71260 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/footprints/servicedesk/aspnetconfig` endpoint by sending malicious serialized data in the `__VIEWSTATE` parameter, enabling remote code execution through Java deserialization vulnerabilities. Subsequent requests to attacker-controlled `.jsp` files on the server confirm successful exploitation.

## Timeline

- 2026-03-19: CVE Published. CVE-2025-71260 is published to NVD.
- 2026-04-01: Rule Released. CrowdSec releases a rule to detect CVE-2025-71260 exploitation attempts against the CrowdSec Network.

## References

- https://www.vulncheck.com/advisories/bmc-footprints-itsm-viewstate-deserialization-rce
- https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/
- https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-71260.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-71260) follows observed exploitation activity for CVE-2025-71260. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.