ServiceNow AI Platform: Plaintext Storage of a Password
CVE-2026-103094 is a high-severity plaintext storage of a password vulnerability in ServiceNow AI Platform from ServiceNow, with a CVSS 4.0 base score of 7.1 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists versions Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a as the first without the flaw, so updating ServiceNow AI Platform to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.27% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update ServiceNow AI Platform to Xanadu Patch 11 Hot Fix 7a or Yokohama Patch 13 Hot Fix 4a or Zurich Patch 10 Hot Fix 3a or Zurich Patch 11 Hot Fix 1, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| ServiceNow | ServiceNow AI Platform | before Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 13 Hot Fix 4a; before Zurich Patch 10 Hot Fix 3a; before Zurich Patch 11 Hot Fix 1; before Zurich Patch 11m (m-branch); before Zurich Patch 12; before Zurich Patch 13; before Australia Patch 2 Hot Fix 3b; and 3 more ranges | Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a, Zurich Patch 11 Hot Fix 1, Zurich Patch 11m (m-branch), Zurich Patch 12 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- PresentThe target must be in a specific state or configuration for the attack to work.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- HighSerious loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- NoneNo loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- NoneNo loss of availability on the vulnerable system.
- Confidentiality (other systems)
- HighSerious loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- HighSerious loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- NoneNo loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (servicenow.com).
Official description
ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who otherwise would not be entitled to view it. ServiceNow remediated the vulnerability through security updates that address the unintended persistence of plaintext credentials. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Plaintext Storage of a Password
The product stores a password in plaintext within resources such as memory or files.
How developers prevent this class of flaw
- Avoid storing passwords in easily accessible locations.
- Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
- A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
More Plaintext Storage of a Password vulnerabilities (CWE-256)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Other vulnerabilities in ServiceNow AI Platform
- 9.4 Critical severity
- 9.3 Critical severity
- 8.7 High severity
- 8.7 High severity
- 8.4 High severity
- 9.3 Critical severity
Recent Plaintext Storage of a Password vulnerabilities
- 8.2 High severity
- 8.7 High severity
- 8.8 High severity
- 7.4 High severity
- 9.1 Critical severity
- 7.1 High severity
Spotted an error? Tell us.