ServiceNow warns of three max severity security vulnerabilities
-
ServiceNow has pushed out patches for three newly disclosed AI Platform vulnerabilities, each carrying the highest possible severity rating. The flaws can be abused in code injection, SQL injection, and privilege escalation attacks, putting unpatched instances at significant risk of full compromise.
The issues affect ServiceNow AI Platform deployments and have been addressed through the latest security patches. While specific attack chains are not yet public, the combination of these vulnerabilities could allow an authenticated or unauthenticated attacker to execute arbitrary code, manipulate database queries, or elevate their privileges within the platform.
Key technical details to be aware of:
- The vulnerabilities are rated as maximum severity (CVSS 10.0).
- Attack vectors include code injection, SQL injection, and privilege escalation.
- ServiceNow has released patches for all three defects; no workarounds have been provided.
Organizations running the affected ServiceNow AI Platform are strongly advised to apply the available patches immediately, as no mitigating controls are currently available. Given the critical nature, prioritise patching in line with your change management process but do not delay.
Source: BleepingComputer
Is your org running ServiceNow AI Platform, and have you had to fast-track this patch ahead of your usual maintenance window?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login