Product by ServiceNow
Servicenow AI Platform
14 known vulnerabilities in Servicenow AI Platform (ServiceNow), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
8
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-18885 | Unauthenticated Remote Code Execution in GraphQL Composite Data API | — | |
| Critical | CVE-2026-74820 | Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause | — | |
| Critical | CVE-2026-18886 | Unauthenticated Privilege Escalation via System Configuration Image Upload Processor | — | |
| Critical | CVE-2026-6875 | Sandbox Escape in ServiceNow AI Platform | — | |
| Critical | CVE-2026-6876 | Sandbox Escape in ServiceNow AI Platform | — | |
| Critical | CVE-2026-0542 | Remote Code Execution in ServiceNow AI Platform | — | |
| Critical | CVE-2026-86860 | Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform | — | |
| Critical | CVE-2026-13016 | Unauthenticated SQL Injection in ServiceNow AI Platform | — | |
| High | CVE-2026-86859 | Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform | — | |
| High | CVE-2026-86858 | Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform | — | |
| High | CVE-2026-86857 | Authorization Bypass in ServiceNow AI Platform | — | |
| Medium | CVE-2025-11449 | Reflected Cross Site Scripting in ServiceNow AI Platform | — | |
| Medium | CVE-2025-11450 | Reflected Cross Site Scripting in ServiceNow AI Platform | — | |
| Medium | CVE-2025-3089 | Broken Access Control in ServiceNow AI Platform | — |
News
- ServiceNow patches three maximum severity flaws that could put enterprise data at riskcsoonline,
- Exploitation of ServiceNow Vulnerability Seen Days After Disclosuresecurityweek,
- Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Executionthehackernews,
- ServiceNow’s sandbox escape RCE hole now exploited in the wildcsoonline,
- Critical ServiceNow code execution flaw now exploited in attacksbleepingcomputer,