Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

41 records

Vendor: ServiceNow Clear all filters
TI-2026-82727 CVE-2026-103093 · GHSA-7xg6-pvqc-rx7p

Sandbox escape in ServiceNow AI Platform allows host code execution

Priority MEDIUM 43

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform.

CVSS 4.0CRITICAL 9.4 Network High privileges No interaction EPSS 0.00429 Published 2026-10-29 Fixed in Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b +3 CWE-284
TI-2026-82726 CVE-2026-6877 · GHSA-4rjv-xgwj-mw34

Domain separation bypass in ServiceNow AI Platform

Priority LOW 24

ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00345 Published 2026-10-29 Fixed in SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) CWE-284
TI-2026-82719 CVE-2026-103094 · GHSA-22w9-gfhr-4v85

Plaintext password storage in ServiceNow AI Platform exposes passwords

Priority LOW 31

ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00269 Published 2026-10-29 Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a +9 CWE-256
TI-2026-59380 CVE-2026-86860 · GHSA-hm4f-jpr2-fpx4

Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform

Priority MEDIUM 48

ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00309 Published 2026-09-24 Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-862
TI-2026-59379 CVE-2026-86859 · GHSA-hv69-7jxx-r484

Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform

Priority MEDIUM 43

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.003 Published 2026-09-24 Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-284
TI-2026-11072 CVE-2026-13016 · GHSA-89wx-h2m8-fc58

Unauthenticated SQL Injection in ServiceNow AI Platform

Priority MEDIUM 42

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00283 Published 2026-09-24 Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-89
TI-2026-59378 CVE-2026-86858 · GHSA-g4fh-c3m5-g3pg

Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform

Priority MEDIUM 43

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00283 Published 2026-09-24 Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-284
TI-2026-59377 CVE-2026-86857 · GHSA-3g9f-q9vc-qffh

Authorization Bypass in ServiceNow AI Platform

Priority LOW 36

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform.

CVSS 4.0HIGH 8.4 Network Low privileges No interaction EPSS 0.00251 Published 2026-09-24 Fixed in Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b +5 CWE-862
TI-2026-52569 CVE-2026-74820 · GHSA-75mr-vw8w-4mx8

Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

Priority MEDIUM 57

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.05148 Published 2026-08-27 Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b +13 CWE-89
TI-2026-15447 CVE-2026-18885 · GHSA-pc3p-j9w8-jrpg

Unauthenticated Remote Code Execution in GraphQL Composite Data API

Priority MEDIUM 59

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.07241 Published 2026-08-27 Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b +13 CWE-94
TI-2026-06032 CVE-2026-6876 · GHSA-7fw9-72q7-3g7j

Sandbox Escape in ServiceNow AI Platform

Priority MEDIUM 44

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00677 Published 2026-08-27 Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b +13 CWE-1284
TI-2026-06031 CVE-2026-6875 · GHSA-8jw2-7qp4-v2jj

Sandbox Escape in ServiceNow AI Platform

Priority MEDIUM 46

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.01426 Published 2026-07-13 Fixed in Australia Patch 2, Yokohama Patch 12 Hot Fix 1b +5 CWE-94
TI-2026-00345 CVE-2026-0542 · GHSA-8h66-rpjm-6pwc

Remote Code Execution in ServiceNow AI Platform

Priority MEDIUM 43

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00664 Published 2026-02-25 Fixed in Australia, Zurich Patch 5 +4 CWE-653
TI-2025-11396 CVE-2025-12420 · GHSA-mwg5-cwh8-88m5

Unauthenticated Privilege Escalation in ServiceNow AI Platform

Priority HIGH 80

A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.53188 Published 2026-01-12 Fixed in 3.15.2, 4.0.4 CWE-250
TI-2025-10489 CVE-2025-11449 · GHSA-pfwj-c5wr-r8pg

Reflected Cross Site Scripting in ServiceNow AI Platform

Priority LOW 30

ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00355 Published 2025-10-10 Fixed in Washington DC Patch 10 Hot Fix 7b, Xanadu Patch 10 Hot Fix 1a +8 CWE-79
TI-2025-10490 CVE-2025-11450 · GHSA-2mg5-34rx-c3p8

Reflected Cross Site Scripting in ServiceNow AI Platform

Priority LOW 24

ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00355 Published 2025-10-10 Fixed in Washington DC Patch 10 Hot Fix 7b, Xanadu Patch 10 Hot Fix 1a +8 CWE-79
TI-2025-02698 CVE-2025-3089 · GHSA-f8j3-r9jj-4qxr

Broken Access Control in ServiceNow AI Platform

Priority LOW 24

ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00394 Published 2025-08-12 Fixed in Washington DC Patch 10 Hot Fix 2a, Xanadu Patch 7a +4 CWE-639
TI-2025-03215 CVE-2025-3648 · GHSA-f77v-7fv6-253h

Data Inference in Now Platform via Conditional ACLs

Priority LOW 39

A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.01675 Published 2025-07-08 No fix listed CWE-1220
TI-2025-00272 CVE-2025-0337 · GHSA-4x8m-chwm-9h7p

Authorization bypass in Now Platform

Priority LOW 31

ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00386 Published 2025-03-06 Fixed in Washington DC Patch 9, Xanadu Patch 4 +1 CWE-639
TI-2024-05461 CVE-2024-5890 · GHSA-4w9h-2rq9-697c

HTML Injection in the Assessment plugin

Priority LOW 23

ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00305 Published 2024-12-02 Fixed in Utah Patch 8 Hot Fix 1, Vancouver Patch 10 +2 CWE-79
TI-2024-08287 CVE-2024-8924 · GHSA-25m4-rhwx-m523

Unauthenticated Blind SQL Injection in Core Platform

Priority MEDIUM 44

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00498 Published 2024-10-29 Fixed in Utah Patch 10b Hot Fix 3, Vancouver Patch 8 Hot Fix 5 +7 CWE-89
TI-2024-08286 CVE-2024-8923 · GHSA-qpr4-w3rc-m373

Sandbox Escape in Now Platform

Priority MEDIUM 50

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01109 Published 2024-10-29 Fixed in Vancouver Patch 9 Hot Fix 2a, Vancouver Patch 10 +3 CWE-94
TI-2024-04841 CVE-2024-5217 · GHSA-5xx6-pf4v-cpf2

Incomplete Input Validation in GlideExpression Script

Priority CRITICAL 99KEV

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.99628 Published 2024-07-10 Fixed in Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2 +11 CWE-184
TI-2024-04807 CVE-2024-5178 · GHSA-qm6x-v3jw-cvp7

Incomplete Input Validation in SecurelyAccess API

Priority MEDIUM 55

ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.33593 Published 2024-07-10 Fixed in Utah Patch 10 Hot Fix 3, Utah Patch 10a Hot Fix 2 +10 CWE-184
Load more