CVE Program partner

SN

ServiceNow

API
CVEs, 365 days1232 all time, 1 rejected
Quality72%median 99%
CVSS by the CNA100%share of records
CWE16%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationServiceNow
RoleCNA
TypeHosted Service, Researcher, Vendor
Reports tomitre
ScopeAll ServiceNow products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by ServiceNow that are not in another CNA’s scope.
Advisorieshttps://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1226057

Latest CVEs · RSS

  • CVE-2026-86860 2026-09-24 · CVSS 9.3
    ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenti
  • CVE-2026-86859 2026-09-24 · CVSS 8.7
    ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could ena
  • CVE-2026-13016 2026-09-24 · CVSS 9.3
    ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated us
  • CVE-2026-86858 2026-09-24 · CVSS 8.7
    ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unaut
  • CVE-2026-86857 2026-09-24 · CVSS 8.4
    ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could ena
  • CVE-2026-74820 2026-08-27 · CVSS 10.0
    ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated
  • CVE-2026-18886 2026-08-27 · CVSS 10.0
    ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthe
  • CVE-2026-18885 2026-08-27 · CVSS 10.0
    ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated u
  • CVE-2026-6876 2026-08-27 · CVSS 10.0
    ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated
  • CVE-2026-6875 2026-07-13 · CVSS 9.5
    ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthentic
  • CVE-2026-0542 2026-02-25 · CVSS 9.2
    ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenti
  • CVE-2025-12420 2026-01-12 · CVSS 9.3
    A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operatio
  • CVE-2025-11449 2025-10-10 · CVSS 5.3
    ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in ar
  • CVE-2025-11450 2025-10-10 · CVSS 5.3
    ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in ar
  • CVE-2025-3089 2025-08-12 · CVSS 5.3
    ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privilege
  • CVE-2025-3648 2025-07-08 · CVSS 8.2
    A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access control
  • CVE-2025-0337 2025-03-06 · CVSS 7.1
    ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploit
  • CVE-2024-5890 2024-12-02 · CVSS 5.1
    ServiceNow has addressed an HTML injection vulnerability that was identified in the Now Platform. This vulnerability could potentially enable an unauthenticated
  • CVE-2024-8924 2024-10-29 · CVSS 8.7
    ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to
  • CVE-2024-8923 2024-10-29 · CVSS 9.3
    ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to r
  • CVE-2024-5217 2024-07-10 · CVSS 9.2
    ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerab
  • CVE-2024-5178 2024-07-10 · CVSS 6.9
    ServiceNow has addressed a sensitive file read vulnerability that was identified in the Washington DC, Vancouver, and Utah Now Platform releases. This vulnerabi
  • CVE-2024-4879 2024-07-10 · CVSS 9.3
    ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could en
  • CVE-2023-3442 2023-07-26 · CVSS 7.7
    A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cau
  • CVE-2023-3414 2023-07-26 · CVSS 6.1
    A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, coul

All CVE Program partners