Read the docs
TI-2026-82719 Aliases CVE-2026-103094GHSA-22w9-gfhr-4v85

Plaintext password storage in ServiceNow AI Platform exposes passwords

Priority LOW 31CWE-256Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-256.

Summary

ServiceNow AI Platform releases before the fixed builds listed for each branch are affected. A flaw stores a user's plaintext password in a system table (CWE-256). A remote attacker with low privileges can read that password when they are not entitled to view it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who otherwise would not be entitled to view it. ServiceNow remediated the vulnerability through security updates that address the unintended persistence of plaintext credentials. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00269 19th percentileScored 2026-11-07
Fix Fixed ServiceNow AI Platform (ServiceNow): Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a +8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ServiceNowServiceNow AI Platformbefore Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 13 Hot Fix 4a; before Zurich Patch 10 Hot Fix 3a; before Zurich Patch 11 Hot Fix 1; before Zurich Patch 11m (m-branch); before Zurich Patch 12; before Zurich Patch 13; before Australia Patch 2 Hot Fix 3b; before Australia Patch 4 Hot Fix 1; before Australia Patch 4m (m-branch); before Australia Patch 5Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a, Zurich Patch 11 Hot Fix 1, Zurich Patch 11m (m-branch), Zurich Patch 12, Zurich Patch 13, Australia Patch 2 Hot Fix 3b, Australia Patch 4 Hot Fix 1, Australia Patch 4m (m-branch), Australia Patch 5Patch availableCNA
  • ServiceNow AI Platform VendorServiceNow Affected before Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 13 Hot Fix 4a; before Zurich Patch 10 Hot Fix 3a; before Zurich Patch 11 Hot Fix 1; before Zurich Patch 11m (m-branch); before Zurich Patch 12; before Zurich Patch 13; before Australia Patch 2 Hot Fix 3b; before Australia Patch 4 Hot Fix 1; before Australia Patch 4m (m-branch); before Australia Patch 5 Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a, Zurich Patch 11 Hot Fix 1, Zurich Patch 11m (m-branch), Zurich Patch 12, Zurich Patch 13, Australia Patch 2 Hot Fix 3b, Australia Patch 4 Hot Fix 1, Australia Patch 4m (m-branch), Australia Patch 5 Patch available CNA

Remediation

Upgrade to the fixed release for each branch: Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a, Zurich Patch 11 Hot Fix 1, Zurich Patch 11m (m-branch), Zurich Patch 12, Zurich Patch 13, Australia Patch 2 Hot Fix 3b, Australia Patch 4 Hot Fix 1, Australia Patch 4m (m-branch) or Australia Patch 5.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA ServiceNow AI Platform (ServiceNow) Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a, Zurich Patch 11 Hot Fix 1, Zurich Patch 11m (m-branch), Zurich Patch 12, Zurich Patch 13, Australia Patch 2 Hot Fix 3b, Australia Patch 4 Hot Fix 1, Australia Patch 4m (m-branch), Australia Patch 5

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-103094
  2. 2026-10-29 Weakness changed · CISA ADP
  3. 2026-10-29 CISA SSVC decision points changed
  4. 2026-10-29 Priority changed: MEDIUM → LOW
  5. 2026-10-29 Alias added: GHSA-22w9-gfhr-4v85

References

Other 1

  • TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-11396 Unauthenticated Privilege Escalation in ServiceNow AI Platform CVSS 4.0CRITICAL 9.3
  • TI-2026-15447 Unauthenticated Remote Code Execution in GraphQL Composite Data API CVSS 4.0CRITICAL 10.0
  • TI-2026-52569 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause CVSS 4.0CRITICAL 10.0
  • TI-2026-15448 Unauthenticated Privilege Escalation via System Configuration Image Upload Processor CVSS 4.0CRITICAL 10.0
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences