TI-2026-82726 Aliases CVE-2026-6877 GHSA-4rjv-xgwj-mw34

Domain separation bypass in ServiceNow AI Platform

LOW 24CWE-284Published 2026-10-29 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

ServiceNow AI Platform is affected in the SR - CSM - Task Plan Templates Store application before SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application). A domain separation bypass, classified as CWE-284, lets an authenticated user with a specific role create records in domains they do not have access to. This can lead to unauthorized data creation across domain boundaries. ServiceNow is not currently aware of malicious exploitation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00345 28th percentileScored 2026-11-07

Fix Fixed ServiceNow AI Platform (ServiceNow): SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ServiceNow	ServiceNow AI Platform	before SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)	SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)	Patch available	CNA

ServiceNow AI Platform VendorServiceNow Affected before SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) Fixed in SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) Patch available CNA

Remediation

Upgrade the SR - CSM - Task Plan Templates application to v3.0 (Task Plan Templates application), which fixes the issue. ServiceNow recommends applying the update or upgrading to a patched release.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Fix · CNA ServiceNow AI Platform (ServiceNow) Fixed in SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)

Timeline

2026-10-29 Threatist record created from CVE-2026-6877
2026-10-29 CISA SSVC decision points changed
2026-10-29 Alias added: GHSA-4rjv-xgwj-mw34

References

Other 1

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994

TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
TI-2025-11396 Unauthenticated Privilege Escalation in ServiceNow AI Platform CVSS 4.0CRITICAL 9.3
TI-2026-15447 Unauthenticated Remote Code Execution in GraphQL Composite Data API CVSS 4.0CRITICAL 10.0
TI-2026-52569 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause CVSS 4.0CRITICAL 10.0
TI-2026-15448 Unauthenticated Privilege Escalation via System Configuration Image Upload Processor CVSS 4.0CRITICAL 10.0

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences