CVE-2025-71257 is an authentication bypass in BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001, rated 7.3 high. Security filters are not enforced on some REST endpoints and servlets, so unauthenticated users can reach restricted functions. BMC has published hotfixes, so apply the one for your release train.
What's affected
Per the record, BMC FootPrints ITSM 20.20.02 through 20.24.01.001.
The record lists these hotfix builds as remediating the issue: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002 and 20.24.01. Match your installed release to the corresponding entry and confirm the exact hotfix in the BMC release notes.
How to check if you're exposed
FootPrints is a hosted application, so check it through the product.
- Read the version from the application as an administrator, and compare it with the range above.
- Open the BMC release notes for the 2024 Release 01 Patch 2 and confirm which hotfix your release train needs.
- Review web server logs for requests to REST endpoints and servlets from unauthenticated sessions that you do not expect.
What to do now
- Identify every FootPrints ITSM instance, including test systems.
- Apply the BMC hotfix for your release train and confirm the version afterwards.
- Do not expose the application to the internet unless it must be. Put it behind a VPN or an access proxy.
- Review logs for unusual unauthenticated access to REST and servlet paths before the patch date.
- Rotate credentials and API tokens stored in the system if logs show unexplained access.
Because the record links a hotfix list and not a single version, the work is mostly matching. Write down your release train, find the entry for it, and apply that hotfix. Confirm in the application afterwards that the version string changed.
ITSM tools are worth an extra look because they connect to many other systems. They hold user records, tickets that mention incidents, and often credentials or API keys for directory, email and asset tools. A bypass of access controls on a system like that is a data exposure problem as well as a system problem.
If the server faces the internet, ask whether it needs to. Most staff use it from inside the network, and a VPN or access proxy removes the open door.
Why it matters
The weakness is CWE-306 (missing authentication for a critical function). Access control was applied by filters, and some restricted endpoints were not covered by them. Unauthenticated callers could then invoke functions meant for signed in users.
The record does not mark this CVE as part of the CISA KEV list. The VulnCheck advisory page says it is in the VulnCheck KEV database, and it links a researcher write up. Read that as a reason to patch promptly, not as proof of attacks on your system.
Authentication filters are a common design, and they fail in a common way. A list of protected paths is kept in one place, and new paths are added elsewhere. Over time some are missed. The record describes this as improper enforcement of security filters on restricted REST endpoints and servlets.
The fix is applied by the vendor, but you can reduce the risk of the next one. Keep internal tools off the open internet, and put an access proxy in front of them that requires login for everything.
Quick check
Is this the same as an authenticated vulnerability?
No. The record says unauthenticated remote attackers can reach restricted functionality, which is why patching and network restriction both matter.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Also referenced by the CVE record:
- https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/
- https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
Last reviewed: 19 October 2026.
