FAIL › dossier
BMC Software
COMPANY FEDRAMP MARKETFedRAMP provider · · dossier confidence 50%
BMC Software is a major provider of ITSM and infrastructure management software with a concerning security track record. The company has suffered critical RCE and file inclusion vulnerabilities in its flagship products, suggesting deep-seated issues in its development and patching processes.
PROFILE
CategoryIT Infrastructure & ITSM SoftwareWhat they doBMC Software provides enterprise IT infrastructure management and IT service management (ITSM) solutions, including products like BMC Remedy and BMC FootPrints.
SECURITY POSTURE
BMC Software has a documented history of critical remote code execution (RCE) and file inclusion vulnerabilities in its core ITSM and infrastructure management platforms, indicating systemic issues with input validation and patch management in edge and server components.
Notable failures
- CVE-2017-17674: Critical RCE via file inclusion in BMC Remedy Mid Tier
- CVE-2025-71257: Authentication bypass in BMC FootPrints ITSM
Patterns: repeated unpatched edge-device RCEs; lack of input validation in core ITSM components
Reputationsevere-fallout (-0.13) · 7 trusted sources
CoverageCISA · NVD · app.opencve.io · cooey · cybersecuritynews.com · www.claimdepot.com
FAILURE HISTORY · 2
| DATE | EVENT | SEV | SUMMARY |
|---|---|---|---|
| 2021-05-19 | CVE-2017-17674 | critical | BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code ex |
| 2026-03-19 | CVE-2025-71257 | high | CVE-2025-71257: BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentica |
SENTIMENT · TRUSTED SOURCES
synthesissevere-fallout-0.80
Damning vulnerability disclosure with no vendor response
Critical RCE vulnerability disclosed
"BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted, the system can be vulnerable to attacks such as system fingerprinting, internal port scanning, Server Side Request Forgery (SSRF), or remote code execution (RCE)."
Neutral database listing
Neutral database listing
Neutral database listing
Neutral database listing
Neutral database listing
Neutral database listing
FEDRAMP CATALOG PRODUCTS · 1
| PRODUCT | STATUS | IMPACT |
|---|---|---|
| BMC Helix | Authorized | Moderate |
Open questions: Are there additional unpatched vulnerabilities in BMC FootPrints beyond CVE-2025-71257? · What is BMC Software's current patch management SLA for critical vulnerabilities?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-08 03:54:16.042936+00:00