Read the docs

BMC

Records97All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical24CVSS 9.0–10.0
CVSS high27CVSS 7.0–8.9

Exploited now

BMC records in CISA KEV

No BMC vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Patrol Agent 13 records HIGH Track-it! 11 records HIGH Control-m/agent 7 records MEDIUM Remedy Mid-tier 7 records MEDIUM Remedy Action Request System 6 records MEDIUM Control-m 5 records HIGH Footprints 4 records HIGH Bladelogic Server Automation Console 3 records HIGH

Records

97 records

TI-2025-43385 CVE-2025-71260 · GHSA-x6vr-xp32-5v9x

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE

Priority HIGH 73

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary co…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.3436 Published 2026-03-19 No fix listed CWE-502
TI-2025-43382 CVE-2025-71257 · GHSA-5pjp-c363-m6g8

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass

Priority HIGH 70

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.45302 Published 2026-03-19 No fix listed CWE-306
TI-2025-43384 CVE-2025-71259 · GHSA-787q-47vg-6mqr

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

Priority MEDIUM 57

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.12916 Published 2026-03-19 No fix listed CWE-918
TI-2025-43383 CVE-2025-71258 · GHSA-9693-8gw9-r7fg

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb

Priority MEDIUM 57

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbi…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.1743 Published 2026-03-19 No fix listed CWE-918
TI-2011-00836 CVE-2011-0975 · GHSA-28rp-84rv-mvr2

Stack-based buffer overflow in BMC PATROL Agent Service Daemon for in Performance…

Priority MEDIUM 53

Stack-based buffer overflow in BMC PATROL Agent Service Daemon for in Performance Analysis for Servers, Performance Assurance for Servers, and Performance Assurance for Virtual Servers 7.4.00 through 7.5.10; Performance…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06826 Published 2011-02-10 No fix listed CWE-119
TI-2008-05678 CVE-2008-5982 · GHSA-r3mj-758w-78mm

Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to…

Priority MEDIUM 53

Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181, which are not properly handled w…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07823 Published 2009-01-27 No fix listed CWE-134
TI-2022-16296 CVE-2022-35865 · GHSA-4q54-fjqv-3cjf

Missing authentication in BMC Track-It!

Priority MEDIUM 52

This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01966 Published 2022-08-03 No fix listed CWE-306
TI-2025-34796 CVE-2025-55108 · GHSA-p7ww-wjh2-g3gw

Missing authentication in BMC Control-M/Agent

Priority MEDIUM 50

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00825 Published 2025-11-05 No fix listed CWE-306
TI-2016-03706 CVE-2016-4322 · GHSA-6pc3-xrhg-jfj4

BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to…

Priority MEDIUM 50

BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication and consequently read arbitrary files or possibly have unspecified other impact by leveraging a "logic flaw" in t…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.05232 Published 2016-12-13 No fix listed CWE-287
TI-2019-12538 CVE-2019-16755 · GHSA-cq5h-qx7v-mjg5

BMC Remedy ITSM Suite is prone to unspecified vulnerabilities in both DWP and SmartIT…

Priority MEDIUM 47

BMC Remedy ITSM Suite is prone to unspecified vulnerabilities in both DWP and SmartIT components, which can permit remote attackers to perform pre-authenticated remote commands execution on the Operating System running t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02505 Published 2019-09-26 No fix listed CWE-502
Load more
Open these records in search →