Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-11449

Reflected Cross Site Scripting in ServiceNow AI Platform

Medium5.3EPSS 0.36%
Published
Updated
Reserved
Assigned by
SN

Description

ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.    ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.

Scores

CVSS scores of CVE-2025-11449, by who scored it
Scored byCVSSScoreVector
SNCNA (assigner)4.0Medium5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
NVDNVD · Deferred4.0Medium5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.36% · top 71% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Affected products

  • ServiceNow · ServiceNow AI Platform

    • affected < Washington DC Patch 10 Hot Fix 7b
    • affected < Xanadu Patch 10 Hot Fix 1a
    • affected < Xanadu Patch 11
    • affected < Yokohama Patch 7 Hot Fix 2a
    • affected < Yokohama Patch 8
    • affected < Yokohama Patch 9
    • affected < Zurich Patch 1 Hot Fix 1a
    • affected < Zurich Patch 2
    • affected < Zurich Patch 3
    • affected < Australia General Availability (GA)

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-11449 badge
[![CVE-2025-11449](https://trackcve.app/badge/CVE-2025-11449.svg)](https://trackcve.app/cve/CVE-2025-11449)

Record last updated .