ServiceNow

Vulnerability activity for ServiceNow: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 3
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 3
Critical (CVSS 9+): 1
Exploited (CISA KEV): 0
With exploit code: 0

Last 365 days

CVEs: 4
Critical (CVSS 9+): 2
Exploited (CISA KEV): 0
With exploit code: 0

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.8CriticalJul 10, 2024ServiceNow Utah, Vancouver, and Washington DC Now PlatformCVE-2024-4879ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. Added to KEV Jul 29, 2024 · 18 days after publicationExploited100% likelyExploit codeExploit-DB · NucleiDetection
9.8CriticalJul 10, 2024ServiceNow Utah, Vancouver, and Washington DC Now PlatformCVE-2024-5217ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.Added to KEV Jul 29, 2024 · 18 days after publicationExploited100% likelyExploit codeNucleiDetection

Recent

5.3MediumOct 29, 2026ServiceNow AI Platform Auth bypass / access controlCVE-2026-6877ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate up
9.4CriticalOct 29, 2026ServiceNow AI Platform Auth bypass / access controlCVE-2026-103093ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of m
7.1HighOct 29, 2026ServiceNow AI Platform Information disclosureCVE-2026-103094ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who otherwise would not be entitled to view it. ServiceNow remediated the vulnerability through security updates that address the unintended persistence of plaintext credentials. We are not currently aware of malicious exploitation against
9.8CriticalJan 12, 2026Servicenow now assist ai agents Privilege escalationCVE-2025-12420A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerab53% likelyDetection
9.8CriticalJul 10, 2024ServiceNow Utah, Vancouver, and Washington DC Now PlatformCVE-2024-5217ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely.Exploited100% likelyExploit codeNucleiDetection
9.8CriticalJul 10, 2024ServiceNow Utah, Vancouver, and Washington DC Now PlatformCVE-2024-4879ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. Exploited100% likelyExploit codeExploit-DB · NucleiDetection

See every ServiceNow entry on the dashboard.