Product by ServiceNow
Now Platform
12 known vulnerabilities in Now Platform (ServiceNow), 2 of them actively exploited (CISA KEV).
Key figures
12
Vulnerabilities
2
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-4879 | Jelly Template Injection Vulnerability in ServiceNow UI Macros In CISA KEValso in 1 other product | 9.8 | |
| Critical | CVE-2024-5217 | Incomplete Input Validation in GlideExpression Script In CISA KEValso in 1 other product | 9.8 | |
| Medium | CVE-2024-5178 | Incomplete Input Validation in SecurelyAccess API | 4.9 | |
| Critical | CVE-2022-43684 | ACL bypass in Reporting functionality | 9.9 | |
| High | CVE-2025-3648 | Data Inference in Now Platform via Conditional ACLs | — | |
| Critical | CVE-2026-6876 | Sandbox Escape in ServiceNow AI Platform | — | |
| Critical | CVE-2024-8923 | Sandbox Escape in Now Platform | 9.8 | |
| Medium | CVE-2022-39048 | Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirect | 6.1 | |
| High | CVE-2024-8924 | Unauthenticated Blind SQL Injection in Core Platform | 7.5 | |
| High | CVE-2025-0337 | Authorization bypass in Now Platform | 6.5 | |
| Medium | CVE-2022-46389 | Cross-Site Scripting (XSS) vulnerability found on logout functionality | 6.1 | |
| Medium | CVE-2024-5890 | HTML Injection in the Assessment plugin | 4.3 |