ServiceNow AI Platform EUVD-2026-113362

Requires an authenticated session as a user holding the ServiceNow admin role on the ServiceNow AI Platform (CVSS PR:H); exploitation then involves bypassing Rhino JavaScript sandbox restrictions to reach the underlying host OS. The specific feature or script path used to trigger the sandbox escape is not described in the available sources. Key limiting factor: the admin-role prerequisite means this cannot be exploited by unauthenticated or low-privileged users, making it a privileged-insider or post-account-compromise vector rather than a broadly exploitable remote flaw; no additional user interaction is required (UI:N). Hosted ServiceNow instances were already updated by the vendor, so exposure is concentrated in self-hosted/partner deployments that have not yet applied the update.

This is a genuine high-priority issue, but its real-world risk is strongly gated by the privilege requirement. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the 9.4 score reflect a network-reachable, low-complexity flaw with full impact on both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H) - consistent with the description's claim that an attacker escapes the Rhino sandbox and runs arbitrary code on the underlying host OS. The decisive mitigating signal is PR:H: exploitation requires an already-authenticated user holding the ServiceNow admin role, so this is a privileged-insider / post-compromise escalation and lateral-movement vector rather than an anonymous internet-facing RCE. The vuln.today decision label is act_now and CWE-284 (improper access control) aligns with a sandbox-restriction bypass. Conflicting/missing signals to note explicitly: no EPSS score was provided, so exploitation probability cannot be quantified; there is no CISA KEV listing and the vendor states it is not currently aware of malicious exploitation, so the act_now label is driven by severity and scope-change potential, not observed activity. The single reference is a vendor KB article, not proof-of-concept code, so no public exploit is evidenced. Net: treat as urgent patching given the host-level impact and act_now label, but recognize the admin-role prerequisite substantially narrows the realistic attacker set.

An authenticated user who already holds the ServiceNow admin role abuses server-side scripting on the AI Platform to break out of the Rhino JavaScript sandbox and execute arbitrary code on the underlying host operating system, converting admin-tier application access into full host compromise and a pivot point for further unintended access. No public exploit or PoC code is evidenced in the provided data; the only reference is a vendor knowledge-base advisory. Because PR:H is required, the scenario presumes a malicious or compromised admin account rather than an unauthenticated outsider.