Priority CRITICAL 99KEV
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.99628 · Published 2024-07-10 · Fixed in Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2 +11 CWE-184
Priority CRITICAL 99KEV
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.99976 · Published 2024-07-10 · Fixed in Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2 +9 CWE-1287
Priority HIGH 80
A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.53188 · Published 2026-01-12 · Fixed in 3.15.2, 4.0.4 CWE-250
Priority MEDIUM 59
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.07241 · Published 2026-08-27 · Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b +13 CWE-94
Priority MEDIUM 57
ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.05148 · Published 2026-08-27 · Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b +13 CWE-89
Priority MEDIUM 57
ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.05041 · Published 2026-08-27 · Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b +13 CWE-284
Priority MEDIUM 55
ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases.
CVSS 4.0MEDIUM 6.9· Network · High privileges · No interaction · EPSS 0.33593 · Published 2024-07-10 · Fixed in Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2 +10 CWE-184
Priority MEDIUM 50
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.01109 · Published 2024-10-29 · Fixed in Vancouver Patch 9 Hot Fix 2a, Vancouver Patch 10 +3 CWE-94
Priority MEDIUM 48
ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00309 · Published 2026-09-24 · Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-862
Priority MEDIUM 46
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform.
CVSS 4.0CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.01426 · Published 2026-07-13 · Fixed in Australia Patch 2, Yokohama Patch 12 Hot Fix 1b +5 CWE-94
Priority MEDIUM 46
ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality.
CVSS 3.1CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.018 · Published 2023-06-13 · Fixed in Patch 10 Hot Fix 8b, Patch 10 Hot Fix 1 +3 CWE-200
Priority MEDIUM 44
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform.
CVSS 4.0CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.00677 · Published 2026-08-27 · Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b +13 CWE-1284
Priority MEDIUM 44
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00498 · Published 2024-10-29 · Fixed in Utah Patch 10b Hot Fix 3, Vancouver Patch 8 Hot Fix 5 +7 CWE-89
Priority MEDIUM 43
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform.
CVSS 4.0CRITICAL 9.4· Network · High privileges · No interaction · EPSS 0.00429 · Published 2026-10-29 · Fixed in Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b +3 CWE-284
Priority MEDIUM 43
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.003 · Published 2026-09-24 · Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-284
Priority MEDIUM 43
ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00283 · Published 2026-09-24 · Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-284
Priority MEDIUM 43
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00664 · Published 2026-02-25 · Fixed in Australia, Zurich Patch 5 +4 CWE-653
Priority MEDIUM 43
report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in the sysparm_media parameter.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02583 · Published 2018-08-03 · No fix listed CWE-94
Priority MEDIUM 42
ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00283 · Published 2026-09-24 · Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-89
Priority LOW 39
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.01675 · Published 2025-07-08 · No fix listed CWE-1220
Priority LOW 39
The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.14316 · Published 2022-02-10 · No fix listed CWE-203
Priority LOW 36
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform.
CVSS 4.0HIGH 8.4· Network · Low privileges · No interaction · EPSS 0.00251 · Published 2026-09-24 · Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-862
Priority LOW 35
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information.
CVSS 3.1HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00711 · Published 2023-07-26 · Fixed in 1.38.1 CWE-862
Priority LOW 32
ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02727 · Published 2022-08-23 · No fix listed CWE-79
Priority LOW 31
ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00269 · Published 2026-10-29 · Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a +9 CWE-256
Load more
THREATIST.IORead the docs