ServiceNow has released security updates to address four vulnerabilities affecting the ServiceNow AI Platform. Three of the flaws carry a maximum CVSS score of 10.0 and are reported as potentially exploitable by unauthenticated attackers under certain circumstances, enabling arbitrary code execution and SQL injection. The fourth flaw has a CVSS score of 9.8. Patches have been deployed to hosted instances and provided to partners and self-hosted customers.

What should defenders do?

Apply the security updates released by ServiceNow. For hosted instances, updates have been automatically deployed. For self-hosted and partner deployments, apply the provided patches immediately to prevent potential exploitation.

criticalvulnerability

ServiceNow Patches Four Critical AI Platform Vulnerabilities Including Three CVSS 10.0 Flaws

Unauthenticated remote code execution and SQL injection risks identified across ServiceNow AI Platform components

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

ServiceNow Patches Four Critical AI Platform Vulnerabilities Including Three CVSS 10.0 Flaws

Key Takeaways

ServiceNow patched four vulnerabilities in the AI Platform, three rated CVSS 10.0 (maximum severity)
Unauthenticated attackers may exploit the flaws under certain circumstances for remote code execution and SQL injection
Patches deployed to hosted instances; updates provided to partners and self-hosted customers

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read