The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)

watchTowr Labs details four chained vulnerabilities discovered in BMC FootPrints ITSM (versions 20.20.02–20.24.01.001) that together enable pre-authenticated remote code execution. The chain starts with an authentication bypass (CVE-2025-71257) via a password reset endpoint that issues a SEC_TOKEN cookie, granting access to otherwise restricted APIs. Two blind SSRF vulnerabilities (CVE-2025-71258, CVE-2025-71259) are also exposed post-bypass. The critical piece is a Java deserialization vulnerability (CVE-2025-71260) in a Mono/.NET-bridged servlet that processes the __VIEWSTATE parameter without validation. Using the AspectJWeaver ysoserial gadget chain, an attacker can write arbitrary files to the web root and achieve RCE. Patches were released by BMC in September 2025; CVEs were assigned in March 2026. A detection artifact generator tool is also released.