Loading story…
Researchers disclosed multiple BMC FootPrints ITSM vulnerabilities that can be chained to achieve pre-authenticated remote code execution, highlighting the product as a high-value target because ITSM platforms often contain asset inventories, incident data, configuration details, and other operationally sensitive information. watchTowr Labs said it found and chained flaws in 2025 against what was then a fully patched deployment, while broader reporting noted a set of four issues affecting the platform and framed the exposure as part of a wider pattern of attackers abusing enterprise management software.
A related disclosure, CVE-2025-71260, affects BMC FootPrints versions 20.20.02 through 20.24.01.001 and stems from unsafe ASP.NET VIEWSTATE deserialization, allowing an authenticated attacker to execute arbitrary code and fully compromise the application. The vendor has issued hotfixes for affected releases, but the references do not all describe the exact same exploit chain: the watchTowr research focuses on pre-auth RCE chains, while the CVE entry covers a specific authenticated deserialization bug, making it adjacent but not fully the same incident thread.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
The Hacker News included the BMC FootPrints pre-authentication RCE chain in its ThreatsDay bulletin as one of several significant security developments. The item was presented as part of a broader roundup rather than a new disclosure.
watchTowr Labs published technical details showing how attackers could obtain a guest-issued SEC_TOKEN, access protected functionality, abuse unsafe Java deserialization in __VIEWSTATE, and write a JSP web shell for pre-authenticated RCE. The disclosure established that fully patched FootPrints deployments were exploitable before the hotfixes.
After the issues were reported, BMC reproduced the exploit chain and issued hotfixes to address the vulnerabilities in affected FootPrints versions. CVEs CVE-2025-71257 through CVE-2025-71260 were assigned to the four flaws.
watchTowr Labs identified four vulnerabilities in BMC FootPrints that could be chained by an unauthenticated attacker to achieve remote code execution on fully patched systems at the time of discovery. The issues affected versions 20.20.02 through 20.24.01.001 and included an authentication bypass, two blind SSRF flaws, and a deserialization bug.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcelabs.watchtowr.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
BeyondTrust disclosed multiple vulnerabilities affecting **Remote Support** and **Privileged Remote Access** appliances, including two critical pre-authentication authentication-bypass flaws tracked as `CVE-2026-40138` and `CVE-2026-40139`. Both issues carry **CVSS 9.2** ratings and can allow remote attackers to gain unauthorized access, including access to elevated-privilege accounts, when a specific authentication configuration is enabled. A separate pre-authentication flaw, `CVE-2026-40140`, was rated **CVSS 8.7** and can be exploited remotely to cause a denial-of-service condition in the network communication subsystem. BeyondTrust also addressed `CVE-2026-40141`, a **CVSS 8.5** vulnerability in a web application component that could let an authenticated low-privilege user access resources or data outside their intended authorization scope. The affected products are **Remote Support 25.3.2 and earlier** and **Privileged Remote Access 25.3.2 and earlier**. The Canadian Centre for Cyber Security urged administrators to review BeyondTrust’s advisory, apply vendor updates, disable the affected authentication configuration where possible, and review access controls and permissions.
Jul 9, 2026
Multiple maximum-severity vulnerabilities in enterprise infrastructure management products are being **actively exploited**, enabling unauthenticated remote code execution as `root` and creating high-impact initial access paths into data center and security operations environments. Reported exploitation includes mass, automated scanning and rapid weaponization following public disclosure and PoC availability, increasing the likelihood of opportunistic compromise, follow-on payload delivery, and lateral movement in affected networks. Fortinet *FortiSIEM* is reported as under active attack via **CVE-2024-23108**, an unauthenticated command-injection issue in the `phMonitor` component (noted as listening on TCP `8014`) that can yield full system compromise. Separately, Cisco *Secure Email Gateway* / *Secure Email and Web Manager* is reported as exploited via **CVE-2024-20353** (CVSS 10.0), with activity attributed to China-linked **UAT-9686** leveraging the Spam Quarantine interface to gain root execution and deploy custom malware for persistence and evasion. In parallel, Check Point-linked reporting describes **RondoDox** botnet-driven exploitation of HPE *OneView* **CVE-2025-37164** at scale (tens of thousands of attempts observed), consistent with an “exploit-shotgun” approach used to build botnets for DDoS, cryptomining, and secondary payload delivery; the surge coincided with the flaw’s addition to CISA’s known-exploited list.
Jun 29, 2026
Trend Micro Mobile Security (Enterprise) 9.8 SP5 through Critical Patch 3 contains two critical flaws, `CVE-2023-32523` and `CVE-2023-32524`, that allow unauthenticated attackers to achieve pre-authenticated remote code execution by chaining an authentication bypass with unrestricted file upload and local file inclusion weaknesses. In both cases, the application trusts a user-controlled `session_info` cookie at the `/widget` endpoint, automatically creates missing `WFUser` accounts with blank passwords, and binds them to a valid PHP session, giving attackers authenticated access without valid credentials. Attackers can then upload an arbitrary PHP file such as `PoolManager.php` into `C:\Windows\Temp` through `proxy_controller.php` and execute it via path traversal or unsanitized `require_once` input in `widget_package_manager.php` or `widgetforsecurity_package_manager.php`. The bugs are rated `CVSS 9.8`, require no authentication or user interaction, and could enable arbitrary code execution on the appliance and follow-on lateral movement. Trend Micro issued fixes on April 18, 2023, and defenders were advised to inspect `C:\Windows\Temp` for unexpected PHP files and review logs for suspicious requests hitting the vulnerable endpoints in close succession.
Jun 29, 2026