EUVD-2026-67221
GHSA-75mr-vw8w-4mx8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network SQLi with no user interaction yields PR:N/UI:N/AC:L; injection into the shared backend database crosses a trust boundary, so S:C with full C/I/A impact.
Primary rating from Vendor (SN).
CVSS VectorVendor: SN
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.
ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.
We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
AnalysisAI
SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arbitrary SQL statements against the instance's underlying database, enabling unauthorized read and modification of instance data beyond intended boundaries. The flaw carries a maximum CVSS 4.0 base score of 10.0 (network, no authentication, high impact to confidentiality, integrity, and availability, with scope-changing impact to subsequent systems). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, unauthenticated exploitation with no user interaction against an affected ServiceNow AI Platform instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue rather than an inflated high-CVSS score: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with high impact across confidentiality, integrity, and availability of both the vulnerable and subsequent systems, yielding the maximum 10.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker who can reach an affected ServiceNow AI Platform instance over the network sends a crafted request to a vulnerable endpoint whose input is passed unsanitized into a backend SQL query. Under the qualifying conditions, the injected SQL executes against the instance database, letting the attacker read or alter records beyond their authorization - for example exfiltrating sensitive tables or tampering with instance data. … |
| Remediation | Patch available per vendor advisory: ServiceNow has already deployed the security update to its hosted instances and distributed the fix to partners and self-hosted customers, so the primary action is to apply the appropriate update or upgrade to the patched release referenced in ServiceNow KB3152242 (https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242); the input does not include an exact fixed version number, so confirm the specific target release from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all ServiceNow AI Platform deployments and network isolation posture; identify which instances process sensitive data and whether they are internet-accessible; engage ServiceNow support for interim guidance and patch timeline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Servicenow Ai Platform
View allRemote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circ
Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to cr
Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumst
Share
External POC / Exploit Code
Leaving vuln.today