BMC Software vulnerabilities
We track 5 vulnerabilities in BMC Software products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on March 19, 2026.
Latest BMC Software vulnerabilities
- 8.8 High severity
FootPrints: Deserialization of Untrusted Data
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted seriali
- 7.1 High severity
FootPrints: Server-Side Request Forgery
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can
- 7.1 High severity
FootPrints: Server-Side Request Forgery
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can e
- 9.1 Critical severity
FootPrints: Missing Authentication for Critical Functionality
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls
- 9.2 Critical severity
Compuware iStrobe Web: Unrestricted Upload of File with Dangerous Type
Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traversal in the file upload form. Attackers can exploit the 'fileName' parameter t