Read the docs

BMC

Records97All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical24CVSS 9.0–10.0
CVSS high27CVSS 7.0–8.9

Exploited now

BMC records in CISA KEV

No BMC vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Patrol Agent 13 records HIGH Track-it! 11 records HIGH Control-m/agent 7 records MEDIUM Remedy Mid-tier 7 records MEDIUM Remedy Action Request System 6 records MEDIUM Control-m 5 records HIGH Footprints 4 records HIGH Bladelogic Server Automation Console 3 records HIGH

Records

4 records in Footprints · all components

TI-2025-43385 CVE-2025-71260 · GHSA-x6vr-xp32-5v9x

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE

Priority HIGH 73

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary co…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.3436 Published 2026-03-19 No fix listed CWE-502
TI-2025-43382 CVE-2025-71257 · GHSA-5pjp-c363-m6g8

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Authentication Bypass

Priority HIGH 70

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.45302 Published 2026-03-19 No fix listed CWE-306
TI-2025-43384 CVE-2025-71259 · GHSA-787q-47vg-6mqr

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in externalfeed/RSS

Priority MEDIUM 57

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.12916 Published 2026-03-19 No fix listed CWE-918
TI-2025-43383 CVE-2025-71258 · GHSA-9693-8gw9-r7fg

BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 Blind SSRF in searchWeb

Priority MEDIUM 57

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbi…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.1743 Published 2026-03-19 No fix listed CWE-918
Open these records in search →