ServiceNow vulnerabilities
34 published CVEs name ServiceNow among the affected products; CISA lists 2 of them as exploited in the wild.
- Published CVEs
- 34
- Last 12 months
- 15
- Critical
- 14
- Known exploited
- 2
Critical 14High 8Medium 12Low 0Not scored 0
CVEs per yearBy the year they were published
- 20238
- 20246
- 20255
- 202615
Known exploitedNewest addition to KEV first
- CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
ServiceNow · Now Platform
ExploitedCritical9.2 - CVE-2024-4879
Jelly Template Injection Vulnerability in ServiceNow UI Macros
ServiceNow · Now Platform
ExploitedCritical9.3
Newest CVEs
- CVE-2026-103093
Sandbox Escape via Table Rotation in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
Critical9.4 - CVE-2026-6877
Domain Separation Bypass in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
Medium5.3 - CVE-2026-103094
Cleartext Storage of OAuth Credentials in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
High7.1 - CVE-2026-86860
Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
Critical9.3 - CVE-2026-86859
Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
High8.7 - CVE-2026-13016
Unauthenticated SQL Injection in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
Critical9.3 - CVE-2026-86858
Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
High8.7 - CVE-2026-86857
Authorization Bypass in ServiceNow AI Platform
ServiceNow · ServiceNow AI Platform
High8.4 - CVE-2026-74820
Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause
ServiceNow · ServiceNow AI Platform
Critical10.0 - CVE-2026-18886
Unauthenticated Privilege Escalation via System Configuration Image Upload Processor
ServiceNow · ServiceNow AI Platform
Critical10.0