Servicenow

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Servicenow product.

RSS Feeds for Servicenow security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Servicenow products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Servicenow Sorted by Most Security Vulnerabilities since 2018

Servicenow22 vulnerabilities

Servicenow It Service Management2 vulnerabilities

Servicenow Ai Platform2 vulnerabilities

Known Exploited Servicenow Vulnerabilities

The following Servicenow vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
ServiceNow Incomplete List of Disallowed Inputs Vulnerability	ServiceNow Washington DC, Vancouver, and earlier Now Platform releases contain an incomplete list of disallowed inputs vulnerability in the GlideExpression script. An unauthenticated user could exploit this vulnerability to execute code remotely. CVE-2024-5217 Exploit Probability: 99.6%	July 29, 2024
ServiceNow Improper Input Validation Vulnerability	ServiceNow Utah, Vancouver, and Washington DC Now releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely. CVE-2024-4879 Exploit Probability: 100.0%	July 29, 2024

Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 7 vulnerabilities in Servicenow with an average score of 9.9 out of ten. Last year, in 2025 Servicenow had 2 security vulnerabilities published. That is, 5 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	7	9.90
2025	2	0.00
2024	5	8.28
2023	7	5.96
2022	3	5.83
2021	0	0.00
2020	1	0.00
2019	0	0.00
2018	2	5.40

It may take a day or so for new Servicenow vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Servicenow Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-74820	Aug 27, 2026	SQLi in ServiceNow AI Platform Enables Unauth DB Manipulation ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.	Servicenow
CVE-2026-18886	Aug 27, 2026	ServiceNow AI Platform Improper Access Control Privilege Escalation ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.	Servicenow
CVE-2026-18885	Aug 27, 2026	ServiceNow AI Platform: AuthZ Code Injection CVE-2026-18885 ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.	Servicenow
CVE-2026-6876	Aug 27, 2026	ServiceNow Now Platform Sandbox Escape For Unauth Exec Code ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.	Servicenow
CVE-2026-6875	Jul 13, 2026	ServiceNow AI RCE via Unauth Access ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.	Servicenow
CVE-2026-0542	Feb 25, 2026	ServiceNow: RCE in AI Platform Sandbox ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.	Servicenow
CVE-2025-12420	Jan 12, 2026	Unauthenticated User Impersonation via ServiceNow AI Platform (CVE-2025-12420) A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.
CVE-2025-11449	Oct 10, 2025	ServiceNow AI Platform XSS: Arbitrary Code via Reflected Links ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.	Servicenow Ai Platform
CVE-2025-11450	Oct 10, 2025	ServiceNow AI Platform Reflected XSS Enables Browser Code Exec ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.	Servicenow Ai Platform
CVE-2024-8924	Oct 29, 2024	ServiceNow Now Platform Blind SQL Injection (CVE-2024-8924) ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to extract unauthorized information. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.	Servicenow