The vulnerability in BMC FootPrints ITSM arises from improper deserialization of data provided in the ASP.NET VIEWSTATE parameter within the application's servlet. This flaw allows an attacker who has authenticated to the system to craft malicious serialized objects that are included in the VIEWSTATE input. Once processed, the deserialization leads to the execution of arbitrary code in the context of the web application, enabling a full compromise of the FootPrints instance. The underlying weakness is identified as CWE‑502: Deserialization of Untrusted Object.

Affected systems are BMC Software, Inc. FootPrints ITSM versions 20.20.02 through 20.24.01.001. The vendor has released multiple hotfixes that fully remediate the issue, including but not limited to 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01. Systems still running any of these versions are exposed.

The CVSS score of 8.7 indicates high severity, while the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated access to the FootPrints interface; once achieved, the attacker can invoke arbitrary code execution. Given the lack of publicly known exploit code, risk escalates only if credentials are compromised or social engineering succeeds. Nevertheless, the potential for full system compromise makes it high risk.