Servicenow
23 CVEs across 11 Servicenow products. Browse Servicenow vulnerabilities, severities, and proof-of-concept exploits.
Servicenow products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6875 | | 2026-07-13 | ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenti… | |
CVE-2026-0542 | | 2026-02-25 | ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthent… | |
CVE-2025-12420 | Critical | 9.8 | 2026-01-12 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operati… |
CVE-2025-11450 | | 2025-10-10 | ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in a… | |
CVE-2025-11449 | | 2025-10-10 | ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in a… | |
CVE-2025-3089 | | 2025-08-12 | ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileg… | |
CVE-2025-3648 | | 2025-07-08 | A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access contro… | |
CVE-2025-0337 | Medium | 6.5 | 2025-03-06 | ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploi… |
CVE-2024-5890 | Medium | 4.3 | 2024-12-02 | ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticate… |
CVE-2024-8924 | High | 7.5 | 2024-10-29 | ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user t… |
CVE-2024-8923 | Critical | 9.8 | 2024-10-29 | ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to… |
CVE-2024-5217 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnera… |
CVE-2024-5178 | Medium | 4.9 | 2024-07-10 | ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerab… |
CVE-2024-4879 | Critical | 9.8 | 2024-07-10 | ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could e… |
CVE-2023-3442 | High | 7.7 | 2023-07-26 | A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could ca… |
CVE-2023-3414 | Medium | 6.1 | 2023-07-26 | A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, cou… |
CVE-2023-1298 | Medium | 4.3 | 2023-07-06 | ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris La… |
CVE-2022-43684 | Critical | 9.9 | 2023-06-13 | ServiceNow has released patches and an upgrade that address an Access Control List (ACL) bypass issue in ServiceNow Core functionality. Additional Details … |
CVE-2023-1209 | Medium | 4.3 | 2023-05-23 | Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts. |
CVE-2022-46389 | Medium | 6.1 | 2023-04-17 | There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego P… |
CVE-2022-46886 | Medium | 5.5 | 2023-04-14 | There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when cl… |
CVE-2022-39048 | Medium | 6.1 | 2023-04-10 | A XSS vulnerability was identified in the ServiceNow UI page assessment_redirect. To exploit this vulnerability, an attacker would need to persuade an authenti… |
CVE-2022-42704 | Medium | 5.4 | 2023-01-13 | A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote att… |
CVE-2022-38463 | Medium | 6.1 | 2022-08-23 | ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. |
CVE-2022-38172 | Medium | 6.1 | 2022-08-23 | ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard. |
CVE-2021-45901 | Medium | 5.3 | 2022-02-10 | The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists. |
CVE-2019-20768 | Medium | 5.4 | 2020-05-05 | ServiceNow IT Service Management Kingston through Patch 14-1, London through Patch 7, and Madrid before patch 4 allow stored XSS via crafted sysparm_item_guid… |
CVE-2018-7748 | High | 8.8 | 2018-08-03 | report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via '${xyz}' Glide Scripting Injection in… |
CVE-2018-8720 | Medium | 5.4 | 2018-03-15 | ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do), or the Search bar of My Portal (aka search_results.do). |