<![CDATA[ServiceNow warns of three max severity security vulnerabilities]]>ServiceNow has pushed out patches for three newly disclosed AI Platform vulnerabilities, each carrying the highest possible severity rating. The flaws can be abused in code injection, SQL injection, and privilege escalation attacks, putting unpatched instances at significant risk of full compromise.

The issues affect ServiceNow AI Platform deployments and have been addressed through the latest security patches. While specific attack chains are not yet public, the combination of these vulnerabilities could allow an authenticated or unauthenticated attacker to execute arbitrary code, manipulate database queries, or elevate their privileges within the platform.

Key technical details to be aware of:

  • The vulnerabilities are rated as maximum severity (CVSS 10.0).
  • Attack vectors include code injection, SQL injection, and privilege escalation.
  • ServiceNow has released patches for all three defects; no workarounds have been provided.

Organizations running the affected ServiceNow AI Platform are strongly advised to apply the available patches immediately, as no mitigating controls are currently available. Given the critical nature, prioritise patching in line with your change management process but do not delay.

Source: BleepingComputer

Is your org running ServiceNow AI Platform, and have you had to fast-track this patch ahead of your usual maintenance window?

]]>https://xploitlk.com/topic/130/servicenow-warns-of-three-max-severity-security-vulnerabilitiesRSS for NodeSat, 05 Sep 2026 14:24:01 GMTFri, 28 Aug 2026 10:30:28 GMT60