ServiceNow AI Platform EUVD-2026-67219

The CVSS metrics (AV:N/AC:L/AT:N/PR:N/UI:N) describe unauthenticated, no-interaction, low-complexity network exploitation against the ServiceNow AI Platform, but the vendor explicitly limits this to 'certain circumstances' that it does not name - meaning a specific, undisclosed feature state, configuration, or deployment mode of the AI Platform is likely required rather than every default instance being trivially exploitable. Concretely, exploitation requires network reachability to a ServiceNow instance running the AI Platform component and that the instance be in the unspecified vulnerable condition; the primary limiting factor is this vendor-noted conditional precondition, and hosted instances are already remediated so the practical exposure is concentrated in unpatched self-hosted/partner-managed instances. The exact triggering circumstance should be confirmed directly with ServiceNow before assuming default-configuration exploitability.

Every static signal points to top-tier priority: CVSS 4.0 is 10.0 with AV:N/AC:L/AT:N/PR:N/UI:N and high impact across both the vulnerable system (VC:H/VI:H/VA:H) and subsequent systems (SC:H/SI:H/SA:H), indicating unauthenticated, low-complexity, no-interaction network exploitation with full compromise and cross-boundary impact. Tags confirm RCE. Counterbalancing this, the vendor description qualifies exploitation as possible only 'in certain circumstances,' which conflicts with the AC:L/AT:N metrics and suggests a real-world precondition the vendor has not disclosed - verify scope with ServiceNow. No EPSS score, no CISA KEV listing, and no known public exploit or POC are present in the data, and ServiceNow reports no observed malicious exploitation; this tempers immediate in-the-wild urgency but does not lower the severity of the underlying flaw, especially since hosted instances were already auto-patched, implying the vendor treated it as critical.

An attacker who can reach an internet-exposed ServiceNow AI Platform instance sends a crafted request to a vulnerable AI Platform feature, injecting code that the platform evaluates server-side. Because no authentication or user interaction is required (PR:N/UI:N), the injected code executes in the instance context, letting the attacker read or alter instance data beyond intended limits. No public POC exists at time of analysis, but the low attack complexity means a working exploit would be straightforward to operationalize if the required circumstances are met.