ServiceNow vulnerabilities
We track 20 vulnerabilities in ServiceNow products across 6 products. 20 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on October 29, 2026.
Latest ServiceNow vulnerabilities
- 7.1 High severity
ServiceNow AI Platform: Plaintext Storage of a Password
ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who
- 9.4 Critical severity
ServiceNow AI Platform: Improper Access Control
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underl
- 9.3 Critical severity
ServiceNow AI Platform: Missing Authorization
ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting i
- 8.7 High severity
ServiceNow AI Platform: Improper Access Control
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise
- 8.7 High severity
ServiceNow AI Platform: Improper Access Control
ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what wa
- 8.4 High severity
ServiceNow AI Platform: Missing Authorization
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise w
- 9.3 Critical severity
ServiceNow AI Platform: Improper Neutralization of Special Elements used in an SQL Command
ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying
- 10.0 Critical severity
ServiceNow AI Platform: Improper Neutralization of Special Elements used in an SQL Command
ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlyi
- 10.0 Critical severity
ServiceNow AI Platform: Improper Control of Generation of Code
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access
- 10.0 Critical severity
ServiceNow AI Platform: Improper Access Control
ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended,
- 10.0 Critical severity
ServiceNow AI Platform: Improper Control of Generation of Code
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access
- 9.5 Critical severity
ServiceNow AI Platform: Improper Control of Generation of Code
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addr
- 9.2 Critical severity
ServiceNow AI Platform: Improper Isolation or Compartmentalization
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox. ServiceNow addre
- 9.8 Critical severity
Now Assist AI Agents: Execution with Unnecessary Privileges
A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability by
- 8.2 High severity
Now Platform: Insufficient Granularity of Access Control
A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control list (ACL) configurations, this vulnerability could enable unauthenticated and authenticated users
- 7.5 High severity
Now Platform: Improper Neutralization of Special Elements used in an SQL Command
ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow
- 10.0 Critical severity
Now Platform: Improper Control of Generation of Code
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted
- 9.8 Critical severity
ServiceNow Incomplete List of Disallowed Inputs Exploited
ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Pl
- 9.8 Critical severity
ServiceNow Improper Input Validation Exploited
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. Servic
- 7.5 High severity
Jenkins plug-in for ServiceNow DevOps: Missing Authorization
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version o