<![CDATA[🔴 Critical: Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL]]>ServiceNow has shipped patches for four security vulnerabilities affecting its AI Platform, with three of them carrying a perfect CVSS 10.0 severity rating. Under specific conditions, these flaws could be exploited by an unauthenticated attacker, potentially leading to arbitrary code execution or SQL injection.

The vendor has already deployed a security update to its hosted instances and provided the corresponding fixes to partners and self-hosted customers. Organizations running their own instances are urged to apply the updates immediately, as the risk of exploitation remains high given the maximum severity score.

  • Three of the four flaws are rated 10.0 on the CVSS scale.
  • The vulnerabilities affect the ServiceNow AI Platform.
  • Exploitation may allow unauthenticated code execution or SQL injection.
  • Patches are available for hosted, partner-managed, and self-hosted environments.

Given the critical nature of these issues, administrators should prioritize verifying their patch status and confirming that no unauthorized access has occurred within their environments.

Source: The Hacker News

Has your organization completed the patching process for these ServiceNow vulnerabilities, and are you monitoring for any signs of exploitation?

]]>https://xploitlk.com/topic/144/critical-three-cvss-10.0-servicenow-flaws-could-let-unauthenticated-attackers-execute-code-and-sqlRSS for NodeSat, 05 Sep 2026 13:30:29 GMTSat, 29 Aug 2026 16:30:29 GMT60