Preliminary research
The Most Organized Threat Actors Use Your ITSM: BMC FootPrints Pre-Auth RCE Chains
AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from March through September. Unranked, incomplete, not community-vetted, and subject to change.
Chains a guest password-reset token through an overly broad authentication check into Java deserialization exposed behind a .NET-style ViewState parameter. The cross-runtime path yields pre-authentication code execution in BMC FootPrints and documents the affected endpoints and fixes.
Record
- Researcher
- Sonny
- Published by
- watchTowr Labs
- Date
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Sonny, first published at the original source. Preserved copies are kept so the citation survives its host.