Log in Start free

ServiceNow

Products

ProductCVEsExploitedLatest
Now Platform112Jul 8, 2025
ServiceNow AI Platform17–Oct 29, 2026
Jenkins plug-in for ServiceNow DevOps2–Jul 26, 2023
ServiceNow1–Apr 14, 2023
ServiceNow Records1–May 23, 2023
Virtual Agent API1–Jan 12, 2026
Now Assist AI Agents1–Jan 12, 2026
Now User Experience1–Jul 6, 2023

Exploited and recent CVEs

  • CVE-2024-5217 Critical 9.8 Exploited Incomplete Input Validation in GlideExpression Script 99.6%
  • CVE-2024-4879 Critical 9.8 Exploited Jelly Template Injection Vulnerability in ServiceNow UI Macros 100.0%
  • CVE-2026-103093 Critical 9.4 Sandbox Escape via Table Rotation in ServiceNow AI Platform 0.4%
  • CVE-2026-6877 Medium 5.3 Domain Separation Bypass in ServiceNow AI Platform 0.3%
  • CVE-2026-103094 High 7.1 Cleartext Storage of OAuth Credentials in ServiceNow AI Platform 0.3%
  • CVE-2026-86860 Critical 9.3 Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform 0.3%
  • CVE-2026-86859 High 8.7 Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform 0.3%
  • CVE-2026-13016 Critical 9.3 Unauthenticated SQL Injection in ServiceNow AI Platform 0.3%
  • CVE-2026-86858 High 8.7 Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform 0.3%
  • CVE-2026-86857 High 8.4 Authorization Bypass in ServiceNow AI Platform 0.3%
  • CVE-2026-74820 Critical 10.0 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause 5.1%
  • CVE-2026-18886 Critical 10.0 Unauthenticated Privilege Escalation via System Configuration Image Upload Processor 5.0%
  • CVE-2026-18885 Critical 10.0 Unauthenticated Remote Code Execution in GraphQL Composite Data API 7.2%
  • CVE-2026-6876 Critical 10.0 Sandbox Escape in ServiceNow AI Platform 0.7%
  • CVE-2026-6875 Critical 9.5 Sandbox Escape in ServiceNow AI Platform 1.4%
  • CVE-2026-0542 Critical 9.2 Remote Code Execution in ServiceNow AI Platform 0.7%
  • CVE-2025-12420 Critical 9.3 Unauthenticated Privilege Escalation in ServiceNow AI Platform 53.2%
  • CVE-2025-12420 Critical 9.3 Unauthenticated Privilege Escalation in ServiceNow AI Platform 53.2%
  • CVE-2025-11449 Medium 5.3 Reflected Cross Site Scripting in ServiceNow AI Platform 0.4%
  • CVE-2025-11450 Medium 5.3 Reflected Cross Site Scripting in ServiceNow AI Platform 0.4%
  • CVE-2025-3089 Medium 5.3 Broken Access Control in ServiceNow AI Platform 0.4%
  • CVE-2025-3648 High 8.2 Data Inference in Now Platform via Conditional ACLs 1.7%
  • CVE-2025-0337 Medium 6.5 Authorization bypass in Now Platform 0.4%
  • CVE-2024-5890 Medium 4.3 HTML Injection in the Assessment plugin 0.3%
  • CVE-2024-8924 High 7.5 Unauthenticated Blind SQL Injection in Core Platform 0.5%
  • CVE-2024-8923 Critical 9.8 Sandbox Escape in Now Platform 1.1%
  • CVE-2024-5178 Medium 4.9 Incomplete Input Validation in SecurelyAccess API 33.6%
  • CVE-2023-3442 High 7.7 Missing Authorization in Jenkins plug-in for ServiceNow DevOps 0.7%
  • CVE-2023-3414 Medium 6.1 Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps 0.4%
  • CVE-2023-1298 Medium 4.3 ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an 0.4%