ServiceNow AI Platform CVE-2026-6877

Requires (1) a valid authenticated account on the ServiceNow instance holding the specific role referenced by the advisory, and (2) the instance to have the SR - CSM - Task Plan Templates Store application installed at a version prior to Task Plan Templates v3.0. The attack is limited to unauthorized record CREATION across domain boundaries - it does not grant read access to other domains' data (VC:N) or affect availability (VA:N). Limiting factors: exploitation is bounded to users who already possess the required role (PR:L), the vulnerable store application must be present (it is not part of every ServiceNow deployment), and only domain-scoped data integrity is at risk. The exact role name and the precise record-creation path that bypasses the domain check are not detailed in the available sources.

This is a medium-severity authorization (domain separation) flaw, not a high-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires an authenticated user holding a specific role (PR:L), and impact is limited to low integrity (VI:L) - unauthorized cross-domain record CREATION only, with no confidentiality (VC:N) or availability (VA:N) impact. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a moderate-risk access-control issue. ServiceNow explicitly states it is 'not currently aware of malicious exploitation,' so there is no KEV listing and no confirmed active exploitation. No EPSS score and no POC/exploit reference were provided in the input, so exploitation probability cannot be quantified from the data. The signals are mutually consistent: a real but bounded insider/authorized-user authorization weakness rather than a widely-weaponized remote threat. The main residual risk is from users who already have legitimate (but role-scoped) access abusing the domain boundary to inject data they should not be able to create.

An authenticated ServiceNow user who holds the specific required role on an instance running the SR - CSM - Task Plan Templates Store application (pre-v3.0) uses the application's record-creation functionality to write records into business domains outside their authorized scope. Because the attack vector is network with low complexity and no user interaction, a single logged-in actor can perform this directly through normal application workflows. No public exploit code or PoC reference was provided in the input.