CVE-2025-71258
MediumPublic exploitBMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests.
Published Mar 19, 2026 · Updated Aug 14, 2026 · Also known as EUVD-2025-208873
Key Facts
Routine patching- CVE-2025-71258 is a medium-severity vulnerability (CVSS 5.3 v4) affecting FootPrints (Bmc), Footprints Itsm (Bmc).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 17% probability of exploitation in the next 30 days.
- Fixed versions are available, including FootPrints 20.24.01.001, Footprints Itsm 20.24.01.001.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v4
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
17%
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2025-71258 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| FootPrintsBmc | >= 20.20.02 | 20.24.01.001 |
| Footprints ItsmBmc | See advisory | 20.24.01.001 |
Patched Releases
FootPrints
20.24.01.001
Footprints Itsm
20.24.01.001
Timeline
Publicly disclosed
Mar 19, 2026
Last updated
Aug 14, 2026
Weakness Type
- CWE-918 Server-Side Request Forgery (SSRF)
References
- advisoryhttps://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/
- advisoryhttps://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
- advisoryhttps://www.vulncheck.com/advisories/bmc-footprints-itsm-blind-ssrf-in-searchweb
FAQ
Common Questions.
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests.
Affected: FootPrints (Bmc) versions >= 20.20.02; Footprints Itsm (Bmc). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including FootPrints 20.24.01.001, Footprints Itsm 20.24.01.001.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2025-71258 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo