CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Called exploited 13 days after disclosure.
Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.
The life of this vulnerability
- CVE published
- First KEV listing13d
- Last sighting5mo
Gaps are compressed to equal steps. The elapsed time is printed under each.
Which catalogues call it exploited
- CISA KEVUS federaldoes not list it
- EUVDENISA, European Uniondoes not list it
- VulnCheck KEVcommercial researchlisted Apr 1, 2026
- CIRCLaggregator, mirrors the abovedoes not list it
This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.
Public exploitation evidence
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-7
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-7
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-7
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-7
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-7
- reported exploitationapi.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2025-7
13 public reports collected from VulnCheck and CIRCL, first on Apr 1, 2026. Each links to its original source. We have not verified them.
Description
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated remote attackers can bypass access controls to invoke restricted functionality and gain unauthorized access to application data and modify system resources. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.