EUVD-2026-67218
GHSA-7fw9-72q7-3g7j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low-complexity sandbox escape; PR:L per official CVSS 4.0 vector; S:U because vendor rates no subsequent-system impact (SC:N/SI:N/SA:N).
Primary rating from Vendor (SN).
CVSS VectorVendor: SN
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
AnalysisAI
Sandbox escape in ServiceNow's Now Platform enables remote code execution within the platform environment, potentially granting attackers access beyond their intended permission level. Scored 8.7 under CVSS 4.0, the vulnerability is network-accessible with low complexity and high impacts on confidentiality, integrity, and availability of the vulnerable system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS 4.0 vector specifies PR:L (low privileges required), implying a valid low-privileged Now Platform account is a prerequisite; however, the CVE description explicitly references exploitation by an 'unauthenticated user,' creating an unresolved conflict - security teams must consult KB3152242 for the authoritative authentication requirement before assessing real exposure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 reflects a high-priority vulnerability: network-accessible (AV:N), low complexity (AC:L), no attack requirements (AT:N), and full high impacts on the vulnerable system's confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | ServiceNow has already deployed the security update to all hosted SaaS instances; no action is required for customers on those deployments. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ServiceNow Now Platform instances across your infrastructure (SaaS and self-hosted) and verify their patch status via ServiceNow's official security advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today