Vendor
ServiceNow
38 known vulnerabilities in products by ServiceNow, 2 of them actively exploited (CISA KEV).
Key figures
38
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
13
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-4879 | Jelly Template Injection Vulnerability in ServiceNow UI Macros In CISA KEV | 9.8 | |
| Critical | CVE-2024-5217 | Incomplete Input Validation in GlideExpression Script In CISA KEV | 9.8 | |
| Critical | CVE-2026-18885 | Unauthenticated Remote Code Execution in GraphQL Composite Data API | — | |
| Critical | CVE-2026-74820 | Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause | — | |
| Critical | CVE-2026-18886 | Unauthenticated Privilege Escalation via System Configuration Image Upload Processor | — | |
| Critical | CVE-2025-12420 | Unauthenticated Privilege Escalation in ServiceNow AI Platform | 9.8 | |
| Medium | CVE-2024-5178 | Incomplete Input Validation in SecurelyAccess API | 4.9 | |
| Critical | CVE-2026-6875 | Sandbox Escape in ServiceNow AI Platform | — | |
| High | CVE-2018-7748 | ServiceNow: Code Execution | 8.8 | |
| Medium | CVE-2021-45901 | ServiceNow: security vulnerability | 5.3 | |
| Critical | CVE-2022-43684 | ACL bypass in Reporting functionality | 9.9 | |
| High | CVE-2025-3648 | Data Inference in Now Platform via Conditional ACLs | — | |
| Critical | CVE-2026-6876 | Sandbox Escape in ServiceNow AI Platform | — | |
| Medium | CVE-2022-38463 | ServiceNow: Cross-Site Scripting (XSS) | 6.1 | |
| Critical | CVE-2024-8923 | Sandbox Escape in Now Platform | 9.8 | |
| Critical | CVE-2026-0542 | Remote Code Execution in ServiceNow AI Platform | — | |
| Critical | CVE-2026-86860 | Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform | — | |
| Critical | CVE-2026-13016 | Unauthenticated SQL Injection in ServiceNow AI Platform | — | |
| High | CVE-2026-86859 | Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform | — | |
| High | CVE-2026-86858 | Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform | — | |
| High | CVE-2026-86857 | Authorization Bypass in ServiceNow AI Platform | — | |
| Medium | CVE-2022-39048 | Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect | 6.1 | |
| High | CVE-2024-8924 | Unauthenticated Blind SQL Injection in Core Platform | 7.5 | |
| High | CVE-2023-3442 | Missing Authorization in Jenkins plug-in for ServiceNow DevOps | 7.7 | |
| High | CVE-2025-0337 | Authorization bypass in Now Platform | 6.5 |
News
- ServiceNow patches three maximum severity flaws that could put enterprise data at riskcsoonline,
- Exploitation of ServiceNow Vulnerability Seen Days After Disclosuresecurityweek,
- Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Executionthehackernews,
- ServiceNow’s sandbox escape RCE hole now exploited in the wildcsoonline,
- Critical ServiceNow code execution flaw now exploited in attacksbleepingcomputer,
Products
| ServiceNow Now Platform | 15 | 2 |
| Servicenow AI Platform | 14 | 0 |
| Now Platform | 12 | 2 |
| AI Platform | 9 | 0 |