ServiceNow AI Platform CVE-2025-11449

Exploitation requires a victim who is a ServiceNow user to click a specially crafted link, so it cannot be triggered autonomously - active social engineering and victim interaction (UI:P) are mandatory limiting factors. No authentication is required of the attacker to craft the link (PR:N), but the payload executes only in the context of the user who clicks it, making targeting of logged-in users the practical prerequisite. The flaw is a reflected XSS in the ServiceNow AI Platform; impact is confined to the browser session (integrity impact, SI:L) with no stated server-side confidentiality, integrity, or availability effect. ServiceNow has already deployed fixes to the majority of hosted instances, so exposure is primarily limited to unpatched self-hosted customers, partners, and uniquely-configured hosted instances.

This is a medium-severity reflected XSS (CWE-79) in the ServiceNow AI Platform, and multiple signals agree it is a lower-priority issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows network reach and no authentication, but it is gated by user interaction (UI:P - the victim must click a crafted link) and the impact is limited to subsequent-system integrity only (SI:L, with VC/VI/VA and SC all N), yielding a modest 5.3 base score. EPSS reinforces low urgency at 0.36% (27th percentile), indicating low modeled probability of exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' A notable conflict exists in the metadata: the issue is tagged 'RCE,' but the description explicitly scopes code execution to the victim's browser (client-side JavaScript), not server-side remote code execution - the 'RCE' tag overstates impact and should not drive prioritization. No SSVC decision data or POC was provided. Overall: a real but moderate client-side flaw whose exploitation requires social engineering; prioritize normal patching, not emergency response.

An attacker crafts a malicious URL pointing at a vulnerable ServiceNow AI Platform endpoint that reflects attacker-controlled input into the page without proper encoding, then lures a logged-in ServiceNow user (e.g., via phishing email or chat message) into clicking it. When the victim opens the link, the injected JavaScript executes in their authenticated browser session, potentially performing actions as that user or manipulating displayed content. No public exploit code was identified at time of analysis, and success depends on the victim actively clicking the link (UI:P).