Search
Find a vulnerability
Search criteria
66 vulnerabilities by Servicenow
CVE-2026-74820 (GCVE-0-2026-74820)
Vulnerability from nvd – Published: 2026-08-27 19:05 – Updated: 2026-08-27 19:05
VLAI
EPSS
VEX
Title
Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause
Summary
ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Affected: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow has \u003c/span\u003e\u003cspan\u003eremediat\u003c/span\u003e\u003cspan\u003eed \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003ea \u003c/span\u003e\u003cspan\u003eSQL injection\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e vulnerability that was \u003c/span\u003e\u003cspan\u003eidentified in\u003c/span\u003e\u003cspan\u003e in the ServiceNow AI platform. \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003eThis vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance\u0027s underlying database and gain access to, or \u003c/span\u003e\u003cspan\u003emodify\u003c/span\u003e\u003cspan\u003e, instance data beyond what was intended.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003edeployed a security update\u003c/span\u003e\u003cspan\u003e to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow \u003c/span\u003e\u003cspan\u003eprovided the update\u003c/span\u003e\u003cspan\u003e to our partners and self-hosted customers. We are not currently aware of\u003c/span\u003e\u003cspan\u003e malicious\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance\u0027s underlying database and gain access to, or modify, instance data beyond what was intended.\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T19:05:04.612Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-74820",
"datePublished": "2026-08-27T19:05:04.612Z",
"dateReserved": "2026-08-17T00:31:50.549Z",
"dateUpdated": "2026-08-27T19:05:04.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6876 (GCVE-0-2026-6876)
Vulnerability from nvd – Published: 2026-08-27 18:46 – Updated: 2026-08-27 18:47
VLAI
EPSS
VEX
Title
Sandbox Escape in Now Platform
Summary
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Affected: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Paul Alkemade"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003ehas \u003c/span\u003e\u003cspan\u003eremediat\u003c/span\u003e\u003cspan\u003eed \u003c/span\u003e\u003cspan\u003ea sandbox escape \u003c/span\u003e\u003cspan\u003esecurity issue\u003c/span\u003e\u003cspan\u003e that was \u003c/span\u003e\u003cspan\u003eidentified\u003c/span\u003e\u003cspan\u003e in the Now Platform. \u003c/span\u003e\u003cspan\u003eThis \u003c/span\u003e\u003cspan\u003esecurity issue \u003c/span\u003e\u003cspan\u003ecould allow an \u003c/span\u003e\u003cspan\u003eunauthenticated\u003c/span\u003e\u003cspan\u003e user to execute arbitrary code within the Now Platform, potentially leading to more access to \u003c/span\u003e\u003cspan\u003ethe \u003c/span\u003e\u003cspan\u003eNow Platform\u003c/span\u003e\u003cspan\u003e t\u003c/span\u003e\u003cspan\u003ehan intended.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003edeployed \u003c/span\u003e\u003cspan\u003ea\u003c/span\u003e\u003cspan\u003e security \u003c/span\u003e\u003cspan\u003eupdate to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow \u003c/span\u003e\u003cspan\u003eprovided \u003c/span\u003e\u003cspan\u003ethe update to our partners and self-hosted customers.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e We are not currently aware of\u003c/span\u003e\u003cspan\u003e malicious\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.\u00a0\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:47:55.772Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sandbox Escape in Now Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-6876",
"datePublished": "2026-08-27T18:46:04.798Z",
"dateReserved": "2026-04-22T18:21:29.674Z",
"dateUpdated": "2026-08-27T18:47:55.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18886 (GCVE-0-2026-18886)
Vulnerability from nvd – Published: 2026-08-27 19:00 – Updated: 2026-08-27 19:00
VLAI
EPSS
VEX
Title
Unauthenticated Privilege Escalation via System Configuration Image Upload Processor
Summary
ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (customZurich Patch 10 Hot Fix 2m (m-branch)) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Unknown: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "customZurich Patch 10 Hot Fix 2m (m-branch)"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "unknown",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kevin Gervot - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow has \u003c/span\u003e\u003cspan\u003eremediated \u003c/span\u003e\u003cspan\u003ea\u003c/span\u003e\u003cspan\u003en\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eimproper access control \u003c/span\u003e\u003cspan\u003evulnerability that was \u003c/span\u003e\u003cspan\u003eidentified\u003c/span\u003e\u003cspan\u003e in the ServiceNow AI platform. \u003c/span\u003e\u003cspan\u003eThis vulnerability could enable an unauthenticated user, in certain circumstances, to create or \u003c/span\u003e\u003cspan\u003emodify\u003c/span\u003e\u003cspan\u003e instance data beyond what was intended, resulting in privilege escalation.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003edeployed \u003c/span\u003e\u003cspan\u003ea security update to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow \u003c/span\u003e\u003cspan\u003eprovided \u003c/span\u003e\u003cspan\u003ethe update to our partners and self-hosted customers. We are not currently aware of \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T19:00:01.715Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Privilege Escalation via System Configuration Image Upload Processor",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-18886",
"datePublished": "2026-08-27T19:00:01.715Z",
"dateReserved": "2026-08-04T19:02:05.799Z",
"dateUpdated": "2026-08-27T19:00:01.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18885 (GCVE-0-2026-18885)
Vulnerability from nvd – Published: 2026-08-27 18:54 – Updated: 2026-08-27 18:54
VLAI
EPSS
VEX
Title
Unauthenticated Remote Code Execution in GraphQL Composite Data API
Summary
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Affected: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow has \u003c/span\u003e\u003cspan\u003eremediat\u003c/span\u003e\u003cspan\u003eed \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003ea\u003c/span\u003e\u003cspan\u003e code injection vulnerability\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e that was \u003c/span\u003e\u003cspan\u003eidentified\u003c/span\u003e\u003cspan\u003e in\u003c/span\u003e\u003cspan\u003e\u0026nbsp;the ServiceNow AI platform. \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003eThis vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and\u0026nbsp;gain access to, or \u003c/span\u003e\u003cspan\u003emodify\u003c/span\u003e\u003cspan\u003e, instance data beyond what was intended.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow deployed a security update to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of\u003c/span\u003e\u003cspan\u003e malicious\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated a code injection vulnerability that was identified in\u00a0the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and\u00a0gain access to, or modify, instance data beyond what was intended.\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:54:14.827Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Remote Code Execution in GraphQL Composite Data API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-18885",
"datePublished": "2026-08-27T18:54:14.827Z",
"dateReserved": "2026-08-04T18:58:01.183Z",
"dateUpdated": "2026-08-27T18:54:14.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6875 (GCVE-0-2026-6875)
Vulnerability from nvd – Published: 2026-07-13 18:17 – Updated: 2026-08-27 16:06Title
Sandbox Escape in ServiceNow AI Platform
Summary
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.
ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.
Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Australia Patch 2
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 1b (custom) Affected: 0 , < Yokohama Patch 13 (custom) Affected: 0 , < Zurich Patch 7b (custom) Affected: 0 , < Zurich Patch 9 (custom) Affected: 0 , < Brazil EA (custom) Affected: 0 , < Brazil GA (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T03:55:45.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Australia Patch 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 1b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Brazil EA",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Brazil GA",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\n\n\n\n\nFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\n\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.5,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T16:06:33.705Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sandbox Escape in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-6875",
"datePublished": "2026-07-13T18:17:27.508Z",
"dateReserved": "2026-04-22T18:21:24.368Z",
"dateUpdated": "2026-08-27T16:06:33.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0542 (GCVE-0-2026-0542)
Vulnerability from nvd – Published: 2026-02-25 20:35 – Updated: 2026-02-26 15:53
VLAI
EPSS
VEX
Title
Remote Code Execution in ServiceNow AI Platform
Summary
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.
ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-26 15:52 UTC
CWE
- CWE-653 - Improper Isolation or Compartmentalization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Australia
(custom)
Affected: 0 , < Zurich Patch 5 (custom) Affected: 0 , < Zurich Patch 4 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 12 (custom) Affected: 0 , < Yokohama Patch 10 Hot Fix 1b (custom) Affected: 0 , < Xanadu Patch 11 Hot Fix 1a (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0542",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-26T15:52:51.206570Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T15:53:05.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Australia",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 4 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 10 Hot Fix 1b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 11 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lockheed Martin - Red Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.\u0026nbsp;\u0026nbsp;\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so. \u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.\u00a0\u00a0\u00a0\n\n\n\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653: Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T20:35:27.303Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2693566"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-0542",
"datePublished": "2026-02-25T20:35:27.303Z",
"dateReserved": "2025-12-30T14:27:44.742Z",
"dateUpdated": "2026-02-26T15:53:05.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12420 (GCVE-0-2025-12420)
Vulnerability from nvd – Published: 2026-01-12 21:29 – Updated: 2026-02-26 15:04
VLAI
EPSS
VEX
Title
Unauthenticated Privilege Escalation in ServiceNow AI Platform
Summary
A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.
ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 04:57 UTC
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.servicenow.com/kb?id=kb_article_v… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Assist AI Agents |
Affected:
5.0.26 , ≤ 5.1.17
(semver)
Affected: 5.0.26 , ≤ 5.2.18 (semver) |
|
| ServiceNow | Virtual Agent API |
Affected:
0 , < 3.15.2
(semver)
Affected: 0 , < 4.0.4 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12420",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T04:57:14.352249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T15:04:50.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Assist AI Agents",
"vendor": "ServiceNow",
"versions": [
{
"lessThanOrEqual": "5.1.17",
"status": "affected",
"version": "5.0.26",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.18",
"status": "affected",
"version": "5.0.26",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Virtual Agent API",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "3.15.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "4.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aaron Costello \u2013 AppOmni"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eA vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.\u003c/p\u003e\u003cp\u003eServiceNow has addressed this vulnerability by deploying a relevant security update to \u0026nbsp;hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e"
}
],
"value": "A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.\n\nServiceNow has addressed this vulnerability by deploying a relevant security update to \u00a0hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250: Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T16:36:53.575Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2587329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Privilege Escalation in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-12420",
"datePublished": "2026-01-12T21:29:37.421Z",
"dateReserved": "2025-10-28T16:31:46.125Z",
"dateUpdated": "2026-02-26T15:04:50.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11450 (GCVE-0-2025-11450)
Vulnerability from nvd – Published: 2025-10-10 01:09 – Updated: 2025-10-10 14:40
VLAI
EPSS
VEX
Title
Reflected Cross Site Scripting in ServiceNow AI Platform
Summary
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.
ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-10 14:39 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Washington DC Patch 10 Hot Fix 7b
(custom)
Affected: 0 , < Xanadu Patch 10 Hot Fix 1a (custom) Affected: 0 , < Xanadu Patch 11 (custom) Affected: 0 , < Yokohama Patch 7 Hot Fix 2a (custom) Affected: 0 , < Yokohama Patch 8 (custom) Affected: 0 , < Yokohama Patch 9 (custom) Affected: 0 , < Zurich Patch 1 Hot Fix 1a (custom) Affected: 0 , < Zurich Patch 2 (custom) Affected: 0 , < Zurich Patch 3 (custom) Affected: 0 , < Australia General Availability (GA) (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-10T14:39:48.553708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T14:40:03.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 10 Hot Fix 7b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 10 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 7 Hot Fix 2a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 1 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia General Availability (GA)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
},
{
"lang": "en",
"type": "finder",
"value": "Shubham Shah - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. \u003cbr\u003e\u003cbr\u003eServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so. \u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. \n\nServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T01:09:54.850Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2552817"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected Cross Site Scripting in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-11450",
"datePublished": "2025-10-10T01:09:54.850Z",
"dateReserved": "2025-10-07T16:35:36.679Z",
"dateUpdated": "2025-10-10T14:40:03.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-11449 (GCVE-0-2025-11449)
Vulnerability from nvd – Published: 2025-10-10 01:15 – Updated: 2025-10-10 18:35
VLAI
EPSS
VEX
Title
Reflected Cross Site Scripting in ServiceNow AI Platform
Summary
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.
ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-10 18:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Washington DC Patch 10 Hot Fix 7b
(custom)
Affected: 0 , < Xanadu Patch 10 Hot Fix 1a (custom) Affected: 0 , < Xanadu Patch 11 (custom) Affected: 0 , < Yokohama Patch 7 Hot Fix 2a (custom) Affected: 0 , < Yokohama Patch 8 (custom) Affected: 0 , < Yokohama Patch 9 (custom) Affected: 0 , < Zurich Patch 1 Hot Fix 1a (custom) Affected: 0 , < Zurich Patch 2 (custom) Affected: 0 , < Zurich Patch 3 (custom) Affected: 0 , < Australia General Availability (GA) (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-10T18:34:08.336304Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T18:35:33.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 10 Hot Fix 7b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 10 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 7 Hot Fix 2a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 1 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia General Availability (GA)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
},
{
"lang": "en",
"type": "finder",
"value": "Shubham Shah - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.\u0026nbsp;\u0026nbsp;\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.\u00a0\u00a0\u00a0\n\n\n\n\n\nServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T01:15:41.132Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2552817"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected Cross Site Scripting in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-11449",
"datePublished": "2025-10-10T01:15:41.132Z",
"dateReserved": "2025-10-07T16:35:31.924Z",
"dateUpdated": "2025-10-10T18:35:33.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3089 (GCVE-0-2025-3089)
Vulnerability from nvd – Published: 2025-08-12 16:06 – Updated: 2025-08-12 18:17
VLAI
EPSS
VEX
Title
Broken Access Control in ServiceNow AI Platform
Summary
ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-12 18:16 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
Aspen , < Washington DC Patch 10 Hot Fix 2a
(custom)
Affected: Aspen , < Xanadu Patch 7a (custom) Affected: Aspen , < Xanadu Patch 8 (custom) Affected: Aspen , < Yokohama Patch 1a (custom) Affected: Aspen , < Yokohama Patch 2 (custom) Affected: Aspen , < Zurich (EA) (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-12T18:16:57.869241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T18:17:15.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 10 Hot Fix 2a",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 7a",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 8",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 1a",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 2",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Zurich (EA)",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Doukani Mohammed Adam"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed a Broken Access Control vulnerability that was identified in the \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow AI Platform\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. \u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications.\u00a0This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T16:33:24.196Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2264930"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-3089",
"datePublished": "2025-08-12T16:06:39.883Z",
"dateReserved": "2025-04-01T13:40:25.043Z",
"dateUpdated": "2025-08-12T18:17:15.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3648 (GCVE-0-2025-3648)
Vulnerability from nvd – Published: 2025-07-08 16:07 – Updated: 2025-08-19 18:37
VLAI
EPSS
VEX
Title
Data Inference in Now Platform via Conditional ACLs
Summary
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.
To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.
Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.
Customers, please review the KB Articles in the References section.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-08 20:36 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://support.servicenow.com/kb?id=kb_article_v… | vendor-advisory |
| https://support.servicenow.com/kb?id=kb_article_v… | permissions-required |
| https://support.servicenow.com/kb?id=kb_article_v… | permissions-required |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
Aspen
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T20:36:46.981615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T20:36:58.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"status": "affected",
"version": "Aspen",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomasz Bukowski (keidii)"
},
{
"lang": "en",
"type": "finder",
"value": "Neta Armon"
},
{
"lang": "en",
"type": "finder",
"value": "Mio Matsushita"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.\u003cbr\u003e\u003cbr\u003eTo assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.\u003cbr\u003e\u003cbr\u003eAdditionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.\u003cbr\u003e\u003cbr\u003eCustomers, please review the KB Articles in the References section."
}
],
"value": "A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.\n\nTo assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.\n\nAdditionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.\n\nCustomers, please review the KB Articles in the References section."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T18:37:03.796Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2139567"
},
{
"tags": [
"permissions-required"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2046494"
},
{
"tags": [
"permissions-required"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2256712"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Data Inference in Now Platform via Conditional ACLs",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-3648",
"datePublished": "2025-07-08T16:07:11.803Z",
"dateReserved": "2025-04-15T13:30:21.572Z",
"dateUpdated": "2025-08-19T18:37:03.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0337 (GCVE-0-2025-0337)
Vulnerability from nvd – Published: 2025-03-06 16:29 – Updated: 2025-03-06 16:41
VLAI
EPSS
VEX
Title
Authorization bypass in Now Platform
Summary
ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access.
This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-06 16:41 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Washington DC Patch 9
(custom)
Affected: 0 , < Xanadu Patch 4 (custom) Affected: 0 , < Yokohama (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-06T16:41:51.687542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T16:41:58.850Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jean-Michel Huguet from the NATO Cyber Security Centre (NCSC)"
},
{
"lang": "en",
"type": "finder",
"value": "Justin Hocquel from the NATO Cyber Security Centre (NCSC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. \u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners. \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. \n\nThis issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T16:29:12.094Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1948695"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authorization bypass in Now Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-0337",
"datePublished": "2025-03-06T16:29:12.094Z",
"dateReserved": "2025-01-08T17:26:47.145Z",
"dateUpdated": "2025-03-06T16:41:58.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5890 (GCVE-0-2024-5890)
Vulnerability from nvd – Published: 2024-12-02 18:24 – Updated: 2024-12-02 19:21
VLAI
EPSS
VEX
Title
HTML Injection in the Assessment plugin
Summary
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.
ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-02 19:20 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Utah Patch 8 Hot Fix 1
(custom)
Affected: 0 , < Vancouver Patch 10 (custom) Affected: 0 , < Vancouver Patch 9 (custom) Affected: 0 , < Washington DC Early Access (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-02T19:20:40.477397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-02T19:21:08.073Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Utah Patch 8 Hot Fix 1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Early Access",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexandre Rodrigo Da Silva"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed an HTML injection vulnerability that was \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eidentified\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e in the Now Platform. This vulnerability could\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e potentially\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e enable an unauthenticated user to \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emodify\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ea\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eweb \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003epage\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e or redirect users to another \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewebsite\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ereleased\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eupdate\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003es\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;to customers\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e that addressed this vulnerability\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIf you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.\n\nServiceNow released updates\u00a0to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-02T18:24:55.797Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1710511"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTML Injection in the Assessment plugin",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2024-5890",
"datePublished": "2024-12-02T18:24:55.797Z",
"dateReserved": "2024-06-12T00:02:00.934Z",
"dateUpdated": "2024-12-02T19:21:08.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8924 (GCVE-0-2024-8924)
Vulnerability from nvd – Published: 2024-10-29 16:14 – Updated: 2024-10-31 03:55
VLAI
EPSS
VEX
Title
Unauthenticated Blind SQL Injection in Core Platform
Summary
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 00:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Utah Patch 10b Hot Fix 3
(custom)
Affected: 0 , < Vancouver Patch 8 Hot Fix 5 (custom) Affected: 0 , < Vancouver Patch 9 Hot Fix 3b (custom) Affected: 0 , < Vancouver Patch 10 Hot Fix 2 (custom) Affected: 0 , < Washington DC Patch 4 Hot Fix 2b (custom) Affected: 0 , < Washington DC Patch 5 Hot Fix 6 (custom) Affected: 0 , < Washington DC Patch 6 Hot Fix 1 (custom) Affected: 0 , < Washington DC Patch 7 (custom) Affected: 0 , < Xanadu Patch 1 (custom) |
|
| servicenow | servicenow |
Affected:
Utah , < Utah Patch 10b Hot Fix 3
(custom)
cpe:2.3:a:servicenow:servicenow:utah:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Vancouver , < Vancouver Patch 8 Hot Fix 5
(custom)
Affected: Vancouver , < Vancouver Patch 9 Hot Fix 3b (custom) Affected: Vancouver , < Vancouver Patch 10 Hot Fix 2 (custom) cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Washington_DC , < Washington DC Patch 4 Hot Fix 2b
(custom)
Affected: Washington_DC , < Washington DC Patch 5 Hot Fix 6 (custom) Affected: Washington_DC , < Washington DC Patch 6 Hot Fix 1 (custom) Affected: Washington_DC , < Washington DC Patch 7 (custom) cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Xanadu , < Xanadu Patch 1
(custom)
cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:utah:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Utah Patch 10b Hot Fix 3",
"status": "affected",
"version": "Utah",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Vancouver Patch 8 Hot Fix 5",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 9 Hot Fix 3b",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10 Hot Fix 2",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Washington DC Patch 4 Hot Fix 2b",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5 Hot Fix 6",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 6 Hot Fix 1",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 7",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Xanadu Patch 1",
"status": "affected",
"version": "Xanadu",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8924",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-31T03:55:17.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Utah Patch 10b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 9 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 4 Hot Fix 2b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 6 Hot Fix 1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "T-Mobile"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eFurther, the vulnerability is addressed in the listed patches and hot fixes.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information.\u00a0ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers.\u00a0Further, the vulnerability is addressed in the listed patches and hot fixes."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T16:14:38.836Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1706072"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Blind SQL Injection in Core Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2024-8924",
"datePublished": "2024-10-29T16:14:38.836Z",
"dateReserved": "2024-09-16T23:37:01.512Z",
"dateUpdated": "2024-10-31T03:55:17.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8923 (GCVE-0-2024-8923)
Vulnerability from nvd – Published: 2024-10-29 16:07 – Updated: 2024-10-31 03:55
VLAI
EPSS
VEX
Title
Sandbox Escape in Now Platform
Summary
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Vancouver Patch 9 Hot Fix 2a
(custom)
Affected: 0 , < Vancouver Patch 10 (custom) Affected: 0 , < Washington DC Patch 4 Hot Fix 1a (custom) Affected: 0 , < Washington DC Patch 5 (custom) Affected: 0 , < Xanadu GA Release (custom) |
|
| servicenow | servicenow |
Affected:
Vancouver , < Vancouver Patch 9 Hot Fix 2a
(custom)
Affected: Vancouver , < Vancouver Patch 10 (custom) cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Washington_DC , < Washington DC Patch 4 Hot Fix 1a
(custom)
Affected: Washington_DC , < Washington DC Patch 5 (custom) cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Xanadu , < Xanadu GA Release
(custom)
cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Vancouver Patch 9 Hot Fix 2a",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Washington DC Patch 4 Hot Fix 1a",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Xanadu GA Release",
"status": "affected",
"version": "Xanadu",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-31T03:55:16.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Vancouver Patch 9 Hot Fix 2a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 4 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu GA Release",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "T-Mobile"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eFurther, the vulnerability is addressed in the listed patches and hot fixes.\u003c/span\u003e"
}
],
"value": "ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform.\u00a0ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers.\u00a0Further, the vulnerability is addressed in the listed patches and hot fixes."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T16:23:19.336Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1706070"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sandbox Escape in Now Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2024-8923",
"datePublished": "2024-10-29T16:07:07.310Z",
"dateReserved": "2024-09-16T23:33:41.375Z",
"dateUpdated": "2024-10-31T03:55:16.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-74820 (GCVE-0-2026-74820)
Vulnerability from cvelistv5 – Published: 2026-08-27 19:05 – Updated: 2026-08-27 19:05
VLAI
EPSS
VEX
Title
Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause
Summary
ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Affected: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow has \u003c/span\u003e\u003cspan\u003eremediat\u003c/span\u003e\u003cspan\u003eed \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003ea \u003c/span\u003e\u003cspan\u003eSQL injection\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e vulnerability that was \u003c/span\u003e\u003cspan\u003eidentified in\u003c/span\u003e\u003cspan\u003e in the ServiceNow AI platform. \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003eThis vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance\u0027s underlying database and gain access to, or \u003c/span\u003e\u003cspan\u003emodify\u003c/span\u003e\u003cspan\u003e, instance data beyond what was intended.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003edeployed a security update\u003c/span\u003e\u003cspan\u003e to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow \u003c/span\u003e\u003cspan\u003eprovided the update\u003c/span\u003e\u003cspan\u003e to our partners and self-hosted customers. We are not currently aware of\u003c/span\u003e\u003cspan\u003e malicious\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance\u0027s underlying database and gain access to, or modify, instance data beyond what was intended.\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T19:05:04.612Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-74820",
"datePublished": "2026-08-27T19:05:04.612Z",
"dateReserved": "2026-08-17T00:31:50.549Z",
"dateUpdated": "2026-08-27T19:05:04.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18886 (GCVE-0-2026-18886)
Vulnerability from cvelistv5 – Published: 2026-08-27 19:00 – Updated: 2026-08-27 19:00
VLAI
EPSS
VEX
Title
Unauthenticated Privilege Escalation via System Configuration Image Upload Processor
Summary
ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (customZurich Patch 10 Hot Fix 2m (m-branch)) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Unknown: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "customZurich Patch 10 Hot Fix 2m (m-branch)"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "unknown",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Kevin Gervot - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow has \u003c/span\u003e\u003cspan\u003eremediated \u003c/span\u003e\u003cspan\u003ea\u003c/span\u003e\u003cspan\u003en\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eimproper access control \u003c/span\u003e\u003cspan\u003evulnerability that was \u003c/span\u003e\u003cspan\u003eidentified\u003c/span\u003e\u003cspan\u003e in the ServiceNow AI platform. \u003c/span\u003e\u003cspan\u003eThis vulnerability could enable an unauthenticated user, in certain circumstances, to create or \u003c/span\u003e\u003cspan\u003emodify\u003c/span\u003e\u003cspan\u003e instance data beyond what was intended, resulting in privilege escalation.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003edeployed \u003c/span\u003e\u003cspan\u003ea security update to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow \u003c/span\u003e\u003cspan\u003eprovided \u003c/span\u003e\u003cspan\u003ethe update to our partners and self-hosted customers. We are not currently aware of \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T19:00:01.715Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Privilege Escalation via System Configuration Image Upload Processor",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-18886",
"datePublished": "2026-08-27T19:00:01.715Z",
"dateReserved": "2026-08-04T19:02:05.799Z",
"dateUpdated": "2026-08-27T19:00:01.715Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18885 (GCVE-0-2026-18885)
Vulnerability from cvelistv5 – Published: 2026-08-27 18:54 – Updated: 2026-08-27 18:54
VLAI
EPSS
VEX
Title
Unauthenticated Remote Code Execution in GraphQL Composite Data API
Summary
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Affected: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow has \u003c/span\u003e\u003cspan\u003eremediat\u003c/span\u003e\u003cspan\u003eed \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003ea\u003c/span\u003e\u003cspan\u003e code injection vulnerability\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e that was \u003c/span\u003e\u003cspan\u003eidentified\u003c/span\u003e\u003cspan\u003e in\u003c/span\u003e\u003cspan\u003e\u0026nbsp;the ServiceNow AI platform. \u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003eThis vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and\u0026nbsp;gain access to, or \u003c/span\u003e\u003cspan\u003emodify\u003c/span\u003e\u003cspan\u003e, instance data beyond what was intended.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow deployed a security update to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of\u003c/span\u003e\u003cspan\u003e malicious\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated a code injection vulnerability that was identified in\u00a0the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and\u00a0gain access to, or modify, instance data beyond what was intended.\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:54:14.827Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Remote Code Execution in GraphQL Composite Data API",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-18885",
"datePublished": "2026-08-27T18:54:14.827Z",
"dateReserved": "2026-08-04T18:58:01.183Z",
"dateUpdated": "2026-08-27T18:54:14.827Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6876 (GCVE-0-2026-6876)
Vulnerability from cvelistv5 – Published: 2026-08-27 18:46 – Updated: 2026-08-27 18:47
VLAI
EPSS
VEX
Title
Sandbox Escape in Now Platform
Summary
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Xanadu Patch 11 Hot Fix 7a
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 13 Hot Fix 4 (custom) Affected: 0 , < Zurich Patch 7b Hot Fix 3 (custom) Affected: 0 , < Zurich Patch 8 Hot Fix 5 (custom) Affected: 0 , < Zurich Patch 9 Hot Fix 6 (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 2m (m-branch) (custom) Affected: 0 , < Zurich Patch 10 Hot Fix 3 (standard) (custom) Affected: 0 , < Zurich Patch 11 (custom) Affected: 0 , < Zurich Patch 12 (custom) Affected: 0 , < Australia Patch 2 Hot Fix 3 (custom) Affected: 0 , < Australia Patch 3 Hot Fix 2 (custom) Affected: 0 , < Australia Patch 3m (custom) Affected: 0 , < Australia Patch 4 (custom) Affected: 0 , < Australia Patch 5 (custom) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Xanadu Patch 11 Hot Fix 7a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13 Hot Fix 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 2m (m-branch)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 10 Hot Fix 3 (standard)",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 2 Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 3m",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Paul Alkemade"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003ehas \u003c/span\u003e\u003cspan\u003eremediat\u003c/span\u003e\u003cspan\u003eed \u003c/span\u003e\u003cspan\u003ea sandbox escape \u003c/span\u003e\u003cspan\u003esecurity issue\u003c/span\u003e\u003cspan\u003e that was \u003c/span\u003e\u003cspan\u003eidentified\u003c/span\u003e\u003cspan\u003e in the Now Platform. \u003c/span\u003e\u003cspan\u003eThis \u003c/span\u003e\u003cspan\u003esecurity issue \u003c/span\u003e\u003cspan\u003ecould allow an \u003c/span\u003e\u003cspan\u003eunauthenticated\u003c/span\u003e\u003cspan\u003e user to execute arbitrary code within the Now Platform, potentially leading to more access to \u003c/span\u003e\u003cspan\u003ethe \u003c/span\u003e\u003cspan\u003eNow Platform\u003c/span\u003e\u003cspan\u003e t\u003c/span\u003e\u003cspan\u003ehan intended.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eServiceNow \u003c/span\u003e\u003cspan\u003edeployed \u003c/span\u003e\u003cspan\u003ea\u003c/span\u003e\u003cspan\u003e security \u003c/span\u003e\u003cspan\u003eupdate to hosted \u003c/span\u003e\u003cspan\u003einstances\u003c/span\u003e\u003cspan\u003e and ServiceNow \u003c/span\u003e\u003cspan\u003eprovided \u003c/span\u003e\u003cspan\u003ethe update to our partners and self-hosted customers.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e We are not currently aware of\u003c/span\u003e\u003cspan\u003e malicious\u003c/span\u003e\u003cspan\u003e \u003c/span\u003e\u003cspan\u003eexploitation \u003c/span\u003e\u003cspan\u003eagainst ServiceNow instances.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cspan\u003e\u003cspan\u003eWe recommend customers promptly apply \u003c/span\u003e\u003cspan\u003eappropriate updates\u003c/span\u003e\u003cspan\u003e or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/span\u003e\u003cspan\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.\u00a0\u00a0\n\n\n\n\n\nServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.\u00a0\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:47:55.772Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3152242"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sandbox Escape in Now Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-6876",
"datePublished": "2026-08-27T18:46:04.798Z",
"dateReserved": "2026-04-22T18:21:29.674Z",
"dateUpdated": "2026-08-27T18:47:55.772Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-6875 (GCVE-0-2026-6875)
Vulnerability from cvelistv5 – Published: 2026-07-13 18:17 – Updated: 2026-08-27 16:06Title
Sandbox Escape in ServiceNow AI Platform
Summary
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.
ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.
Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-13 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Australia Patch 2
(custom)
Affected: 0 , < Yokohama Patch 12 Hot Fix 1b (custom) Affected: 0 , < Yokohama Patch 13 (custom) Affected: 0 , < Zurich Patch 7b (custom) Affected: 0 , < Zurich Patch 9 (custom) Affected: 0 , < Brazil EA (custom) Affected: 0 , < Brazil GA (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-6875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-14T03:55:45.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Australia Patch 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12 Hot Fix 1b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 13",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 7b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Brazil EA",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Brazil GA",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\n\n\n\n\nFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\n\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.5,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T16:06:33.705Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sandbox Escape in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-6875",
"datePublished": "2026-07-13T18:17:27.508Z",
"dateReserved": "2026-04-22T18:21:24.368Z",
"dateUpdated": "2026-08-27T16:06:33.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-0542 (GCVE-0-2026-0542)
Vulnerability from cvelistv5 – Published: 2026-02-25 20:35 – Updated: 2026-02-26 15:53
VLAI
EPSS
VEX
Title
Remote Code Execution in ServiceNow AI Platform
Summary
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.
ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-26 15:52 UTC
CWE
- CWE-653 - Improper Isolation or Compartmentalization
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Australia
(custom)
Affected: 0 , < Zurich Patch 5 (custom) Affected: 0 , < Zurich Patch 4 Hot Fix 3b (custom) Affected: 0 , < Yokohama Patch 12 (custom) Affected: 0 , < Yokohama Patch 10 Hot Fix 1b (custom) Affected: 0 , < Xanadu Patch 11 Hot Fix 1a (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-0542",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-26T15:52:51.206570Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T15:53:05.161Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Australia",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 4 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 12",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 10 Hot Fix 1b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 11 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lockheed Martin - Red Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.\u0026nbsp;\u0026nbsp;\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so. \u003c/p\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.\u00a0\u00a0\u00a0\n\n\n\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-653",
"description": "CWE-653: Improper Isolation or Compartmentalization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T20:35:27.303Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2693566"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Remote Code Execution in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2026-0542",
"datePublished": "2026-02-25T20:35:27.303Z",
"dateReserved": "2025-12-30T14:27:44.742Z",
"dateUpdated": "2026-02-26T15:53:05.161Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-12420 (GCVE-0-2025-12420)
Vulnerability from cvelistv5 – Published: 2026-01-12 21:29 – Updated: 2026-02-26 15:04
VLAI
EPSS
VEX
Title
Unauthenticated Privilege Escalation in ServiceNow AI Platform
Summary
A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.
ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-14 04:57 UTC
CWE
- CWE-250 - Execution with Unnecessary Privileges
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://support.servicenow.com/kb?id=kb_article_v… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Assist AI Agents |
Affected:
5.0.26 , ≤ 5.1.17
(semver)
Affected: 5.0.26 , ≤ 5.2.18 (semver) |
|
| ServiceNow | Virtual Agent API |
Affected:
0 , < 3.15.2
(semver)
Affected: 0 , < 4.0.4 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-12420",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-14T04:57:14.352249Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T15:04:50.165Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Assist AI Agents",
"vendor": "ServiceNow",
"versions": [
{
"lessThanOrEqual": "5.1.17",
"status": "affected",
"version": "5.0.26",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.2.18",
"status": "affected",
"version": "5.0.26",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Virtual Agent API",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "3.15.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "4.0.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Aaron Costello \u2013 AppOmni"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cp\u003eA vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.\u003c/p\u003e\u003cp\u003eServiceNow has addressed this vulnerability by deploying a relevant security update to \u0026nbsp;hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e"
}
],
"value": "A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.\n\nServiceNow has addressed this vulnerability by deploying a relevant security update to \u00a0hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "USER",
"Safety": "NEGLIGIBLE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250: Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-13T16:36:53.575Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2587329"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Privilege Escalation in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-12420",
"datePublished": "2026-01-12T21:29:37.421Z",
"dateReserved": "2025-10-28T16:31:46.125Z",
"dateUpdated": "2026-02-26T15:04:50.165Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11449 (GCVE-0-2025-11449)
Vulnerability from cvelistv5 – Published: 2025-10-10 01:15 – Updated: 2025-10-10 18:35
VLAI
EPSS
VEX
Title
Reflected Cross Site Scripting in ServiceNow AI Platform
Summary
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.
ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-10 18:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Washington DC Patch 10 Hot Fix 7b
(custom)
Affected: 0 , < Xanadu Patch 10 Hot Fix 1a (custom) Affected: 0 , < Xanadu Patch 11 (custom) Affected: 0 , < Yokohama Patch 7 Hot Fix 2a (custom) Affected: 0 , < Yokohama Patch 8 (custom) Affected: 0 , < Yokohama Patch 9 (custom) Affected: 0 , < Zurich Patch 1 Hot Fix 1a (custom) Affected: 0 , < Zurich Patch 2 (custom) Affected: 0 , < Zurich Patch 3 (custom) Affected: 0 , < Australia General Availability (GA) (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-10T18:34:08.336304Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T18:35:33.224Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 10 Hot Fix 7b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 10 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 7 Hot Fix 2a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 1 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia General Availability (GA)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
},
{
"lang": "en",
"type": "finder",
"value": "Shubham Shah - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003e\u003cp\u003eServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.\u0026nbsp;\u0026nbsp;\u0026nbsp;\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003c/div\u003e\u003cdiv\u003e\u003cp\u003eServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.\u003c/p\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.\u00a0\u00a0\u00a0\n\n\n\n\n\nServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T01:15:41.132Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2552817"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected Cross Site Scripting in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-11449",
"datePublished": "2025-10-10T01:15:41.132Z",
"dateReserved": "2025-10-07T16:35:31.924Z",
"dateUpdated": "2025-10-10T18:35:33.224Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-11450 (GCVE-0-2025-11450)
Vulnerability from cvelistv5 – Published: 2025-10-10 01:09 – Updated: 2025-10-10 14:40
VLAI
EPSS
VEX
Title
Reflected Cross Site Scripting in ServiceNow AI Platform
Summary
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.
ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-10 14:39 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
0 , < Washington DC Patch 10 Hot Fix 7b
(custom)
Affected: 0 , < Xanadu Patch 10 Hot Fix 1a (custom) Affected: 0 , < Xanadu Patch 11 (custom) Affected: 0 , < Yokohama Patch 7 Hot Fix 2a (custom) Affected: 0 , < Yokohama Patch 8 (custom) Affected: 0 , < Yokohama Patch 9 (custom) Affected: 0 , < Zurich Patch 1 Hot Fix 1a (custom) Affected: 0 , < Zurich Patch 2 (custom) Affected: 0 , < Zurich Patch 3 (custom) Affected: 0 , < Australia General Availability (GA) (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-10T14:39:48.553708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T14:40:03.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 10 Hot Fix 7b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 10 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 11",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 7 Hot Fix 2a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 8",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 1 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Zurich Patch 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Australia General Availability (GA)",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Adam Kues - Assetnote"
},
{
"lang": "en",
"type": "finder",
"value": "Shubham Shah - Assetnote"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. \u003cbr\u003e\u003cbr\u003eServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so. \u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. \n\nServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-10T01:09:54.850Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2552817"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reflected Cross Site Scripting in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-11450",
"datePublished": "2025-10-10T01:09:54.850Z",
"dateReserved": "2025-10-07T16:35:36.679Z",
"dateUpdated": "2025-10-10T14:40:03.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3089 (GCVE-0-2025-3089)
Vulnerability from cvelistv5 – Published: 2025-08-12 16:06 – Updated: 2025-08-12 18:17
VLAI
EPSS
VEX
Title
Broken Access Control in ServiceNow AI Platform
Summary
ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-12 18:16 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform |
Affected:
Aspen , < Washington DC Patch 10 Hot Fix 2a
(custom)
Affected: Aspen , < Xanadu Patch 7a (custom) Affected: Aspen , < Xanadu Patch 8 (custom) Affected: Aspen , < Yokohama Patch 1a (custom) Affected: Aspen , < Yokohama Patch 2 (custom) Affected: Aspen , < Zurich (EA) (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3089",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-12T18:16:57.869241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T18:17:15.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ServiceNow AI Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 10 Hot Fix 2a",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 7a",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 8",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 1a",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Yokohama Patch 2",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
},
{
"lessThan": "Zurich (EA)",
"status": "affected",
"version": "Aspen",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Doukani Mohammed Adam"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed a Broken Access Control vulnerability that was identified in the \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow AI Platform\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. \u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications.\u00a0This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-12T16:33:24.196Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2264930"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Broken Access Control in ServiceNow AI Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-3089",
"datePublished": "2025-08-12T16:06:39.883Z",
"dateReserved": "2025-04-01T13:40:25.043Z",
"dateUpdated": "2025-08-12T18:17:15.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-3648 (GCVE-0-2025-3648)
Vulnerability from cvelistv5 – Published: 2025-07-08 16:07 – Updated: 2025-08-19 18:37
VLAI
EPSS
VEX
Title
Data Inference in Now Platform via Conditional ACLs
Summary
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.
To assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.
Additionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.
Customers, please review the KB Articles in the References section.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-08 20:36 UTC
CWE
- CWE-1220 - Insufficient Granularity of Access Control
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://support.servicenow.com/kb?id=kb_article_v… | vendor-advisory |
| https://support.servicenow.com/kb?id=kb_article_v… | permissions-required |
| https://support.servicenow.com/kb?id=kb_article_v… | permissions-required |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
Aspen
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-3648",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-08T20:36:46.981615Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-08T20:36:58.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"status": "affected",
"version": "Aspen",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tomasz Bukowski (keidii)"
},
{
"lang": "en",
"type": "finder",
"value": "Neta Armon"
},
{
"lang": "en",
"type": "finder",
"value": "Mio Matsushita"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.\u003cbr\u003e\u003cbr\u003eTo assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.\u003cbr\u003e\u003cbr\u003eAdditionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.\u003cbr\u003e\u003cbr\u003eCustomers, please review the KB Articles in the References section."
}
],
"value": "A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users to use range query requests to infer instance data that is not intended to be accessible to them.\n\nTo assist customers in enhancing access controls, ServiceNow has introduced additional access control frameworks in Xanadu and Yokohama, such as Query ACLs, Security Data Filters and Deny-Unless ACLs.\n\nAdditionally, in May 2025, ServiceNow delivered to customers a security update that is designed to enhance customer ACL configurations.\n\nCustomers, please review the KB Articles in the References section."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1220",
"description": "CWE-1220: Insufficient Granularity of Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-19T18:37:03.796Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2139567"
},
{
"tags": [
"permissions-required"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2046494"
},
{
"tags": [
"permissions-required"
],
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB2256712"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Data Inference in Now Platform via Conditional ACLs",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-3648",
"datePublished": "2025-07-08T16:07:11.803Z",
"dateReserved": "2025-04-15T13:30:21.572Z",
"dateUpdated": "2025-08-19T18:37:03.796Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-0337 (GCVE-0-2025-0337)
Vulnerability from cvelistv5 – Published: 2025-03-06 16:29 – Updated: 2025-03-06 16:41
VLAI
EPSS
VEX
Title
Authorization bypass in Now Platform
Summary
ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access.
This issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-06 16:41 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Washington DC Patch 9
(custom)
Affected: 0 , < Xanadu Patch 4 (custom) Affected: 0 , < Yokohama (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-0337",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-06T16:41:51.687542Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T16:41:58.850Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Washington DC Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 4",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Yokohama",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jean-Michel Huguet from the NATO Cyber Security Centre (NCSC)"
},
{
"lang": "en",
"type": "finder",
"value": "Justin Hocquel from the NATO Cyber Security Centre (NCSC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. \u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners. \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploited, potentially could enable an authenticated user to access unauthorized data stored within the Now Platform that the user otherwise would not be entitled to access. \n\nThis issue is addressed in the listed patches and family release, which have been made available to hosted and self-hosted customers, as well as partners."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-06T16:29:12.094Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1948695"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authorization bypass in Now Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2025-0337",
"datePublished": "2025-03-06T16:29:12.094Z",
"dateReserved": "2025-01-08T17:26:47.145Z",
"dateUpdated": "2025-03-06T16:41:58.850Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5890 (GCVE-0-2024-5890)
Vulnerability from cvelistv5 – Published: 2024-12-02 18:24 – Updated: 2024-12-02 19:21
VLAI
EPSS
VEX
Title
HTML Injection in the Assessment plugin
Summary
ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.
ServiceNow released updates to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-02 19:20 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Utah Patch 8 Hot Fix 1
(custom)
Affected: 0 , < Vancouver Patch 10 (custom) Affected: 0 , < Vancouver Patch 9 (custom) Affected: 0 , < Washington DC Early Access (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5890",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-02T19:20:40.477397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-02T19:21:08.073Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Utah Patch 8 Hot Fix 1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 9",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Early Access",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alexandre Rodrigo Da Silva"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed an HTML injection vulnerability that was \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eidentified\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e in the Now Platform. This vulnerability could\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e potentially\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e enable an unauthenticated user to \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emodify\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ea\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eweb \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003epage\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e or redirect users to another \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ewebsite\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ereleased\u003c/span\u003e \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eupdate\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003es\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;to customers\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e that addressed this vulnerability\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e. \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIf you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated user to modify a web page or redirect users to another website.\n\nServiceNow released updates\u00a0to customers that addressed this vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance(s) as soon as possible."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-02T18:24:55.797Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1710511"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTML Injection in the Assessment plugin",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2024-5890",
"datePublished": "2024-12-02T18:24:55.797Z",
"dateReserved": "2024-06-12T00:02:00.934Z",
"dateUpdated": "2024-12-02T19:21:08.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8924 (GCVE-0-2024-8924)
Vulnerability from cvelistv5 – Published: 2024-10-29 16:14 – Updated: 2024-10-31 03:55
VLAI
EPSS
VEX
Title
Unauthenticated Blind SQL Injection in Core Platform
Summary
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 00:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Utah Patch 10b Hot Fix 3
(custom)
Affected: 0 , < Vancouver Patch 8 Hot Fix 5 (custom) Affected: 0 , < Vancouver Patch 9 Hot Fix 3b (custom) Affected: 0 , < Vancouver Patch 10 Hot Fix 2 (custom) Affected: 0 , < Washington DC Patch 4 Hot Fix 2b (custom) Affected: 0 , < Washington DC Patch 5 Hot Fix 6 (custom) Affected: 0 , < Washington DC Patch 6 Hot Fix 1 (custom) Affected: 0 , < Washington DC Patch 7 (custom) Affected: 0 , < Xanadu Patch 1 (custom) |
|
| servicenow | servicenow |
Affected:
Utah , < Utah Patch 10b Hot Fix 3
(custom)
cpe:2.3:a:servicenow:servicenow:utah:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Vancouver , < Vancouver Patch 8 Hot Fix 5
(custom)
Affected: Vancouver , < Vancouver Patch 9 Hot Fix 3b (custom) Affected: Vancouver , < Vancouver Patch 10 Hot Fix 2 (custom) cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Washington_DC , < Washington DC Patch 4 Hot Fix 2b
(custom)
Affected: Washington_DC , < Washington DC Patch 5 Hot Fix 6 (custom) Affected: Washington_DC , < Washington DC Patch 6 Hot Fix 1 (custom) Affected: Washington_DC , < Washington DC Patch 7 (custom) cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Xanadu , < Xanadu Patch 1
(custom)
cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:utah:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Utah Patch 10b Hot Fix 3",
"status": "affected",
"version": "Utah",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Vancouver Patch 8 Hot Fix 5",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 9 Hot Fix 3b",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10 Hot Fix 2",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Washington DC Patch 4 Hot Fix 2b",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5 Hot Fix 6",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 6 Hot Fix 1",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 7",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Xanadu Patch 1",
"status": "affected",
"version": "Xanadu",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8924",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-31T03:55:17.683Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Utah Patch 10b Hot Fix 3",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 8 Hot Fix 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 9 Hot Fix 3b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10 Hot Fix 2",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 4 Hot Fix 2b",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5 Hot Fix 6",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 6 Hot Fix 1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu Patch 1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "T-Mobile"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eFurther, the vulnerability is addressed in the listed patches and hot fixes.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information.\u00a0ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers.\u00a0Further, the vulnerability is addressed in the listed patches and hot fixes."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T16:14:38.836Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1706072"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Blind SQL Injection in Core Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2024-8924",
"datePublished": "2024-10-29T16:14:38.836Z",
"dateReserved": "2024-09-16T23:37:01.512Z",
"dateUpdated": "2024-10-31T03:55:17.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-8923 (GCVE-0-2024-8923)
Vulnerability from cvelistv5 – Published: 2024-10-29 16:07 – Updated: 2024-10-31 03:55
VLAI
EPSS
VEX
Title
Sandbox Escape in Now Platform
Summary
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-30 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| ServiceNow | Now Platform |
Affected:
0 , < Vancouver Patch 9 Hot Fix 2a
(custom)
Affected: 0 , < Vancouver Patch 10 (custom) Affected: 0 , < Washington DC Patch 4 Hot Fix 1a (custom) Affected: 0 , < Washington DC Patch 5 (custom) Affected: 0 , < Xanadu GA Release (custom) |
|
| servicenow | servicenow |
Affected:
Vancouver , < Vancouver Patch 9 Hot Fix 2a
(custom)
Affected: Vancouver , < Vancouver Patch 10 (custom) cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Washington_DC , < Washington DC Patch 4 Hot Fix 1a
(custom)
Affected: Washington_DC , < Washington DC Patch 5 (custom) cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:* |
|
| servicenow | servicenow |
Affected:
Xanadu , < Xanadu GA Release
(custom)
cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:vancouver:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Vancouver Patch 9 Hot Fix 2a",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10",
"status": "affected",
"version": "Vancouver",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:washington_dc:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Washington DC Patch 4 Hot Fix 1a",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5",
"status": "affected",
"version": "Washington_DC",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:servicenow:servicenow:xanadu:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "servicenow",
"vendor": "servicenow",
"versions": [
{
"lessThan": "Xanadu GA Release",
"status": "affected",
"version": "Xanadu",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-8923",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-31T03:55:16.080Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Now Platform",
"vendor": "ServiceNow",
"versions": [
{
"lessThan": "Vancouver Patch 9 Hot Fix 2a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Vancouver Patch 10",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 4 Hot Fix 1a",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Washington DC Patch 5",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "Xanadu GA Release",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "T-Mobile"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eFurther, the vulnerability is addressed in the listed patches and hot fixes.\u003c/span\u003e"
}
],
"value": "ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform.\u00a0ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers.\u00a0Further, the vulnerability is addressed in the listed patches and hot fixes."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T16:23:19.336Z",
"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"shortName": "SN"
},
"references": [
{
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB1706070"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Sandbox Escape in Now Platform",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
"assignerShortName": "SN",
"cveId": "CVE-2024-8923",
"datePublished": "2024-10-29T16:07:07.310Z",
"dateReserved": "2024-09-16T23:33:41.375Z",
"dateUpdated": "2024-10-31T03:55:16.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}