ServiceNow October 2026 CVE advisory

Vulnerability

Published 2026-10-30 New

Verified 2026-10-31

ServiceNow October 2026 CVE advisory: AI Platform sandbox escape CVE-2026-103093 (CVSS 4.0 9.4, Critical) lets an authenticated admin run code on the host OS; plaintext password exposure and domain separation bypass also fixed

ServiceNow published CVE records on 29 October 2026 (UTC) for three ServiceNow AI Platform issues, each pointing to its knowledge base article KB3228994, titled 'October 2026 CVE Advisory Notification'.

ServiceNow says CVE-2026-103093 (CVSS 4.0 9.4, Critical), 'Sandbox Escape via Table Rotation', could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system. CVE-2026-103094 (CVSS 4.0 7.1, High) could cause a user's plaintext password to be persisted in a system table, exposing it to a user not otherwise entitled to view it.

CVE-2026-6877 (CVSS 4.0 5.3, Medium) is a domain separation bypass in the SR – CSM – Task Plan Templates Store application that could let a user with a specific role create records in domains they cannot access.

ServiceNow says it deployed an update to hosted instances, provided the update to partners and self-hosted customers, and is not currently aware of malicious exploitation. The knowledge base article itself did not render for the desk; details here are from ServiceNow's CVE records. (source: ServiceNow CVE records via cve.org)

Product

ServiceNow AI Platform (CVE-2026-103093, CVE-2026-103094); SR – CSM – Task Plan Templates Store application (CVE-2026-6877)

Versions

Per ServiceNow's CVE records (as of 31 Oct), affected versions are earlier than: CVE-2026-103093 — Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b, Zurich Patch 12, Zurich Patch 13, Australia Patch 5; CVE-2026-103094 — Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3a, Zurich Patch 11 Hot Fix 1, Zurich Patch 11m (m-branch), Zurich Patch 12, Zurich Patch 13, Australia Patch 2 Hot Fix 3b, Australia Patch 4 Hot Fix 1, Australia Patch 4m (m-branch), Australia Patch 5; CVE-2026-6877 — SR - CSM - Task Plan Templates v3.0. Hosted instances: updated by ServiceNow.

CVSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

AVAttack Vector: Network
ACAttack Complexity: Low
ATAttack Requirements: None
PRPrivileges Required: High
UIUser Interaction: None
VCVulnerable System Confidentiality: High
VIVulnerable System Integrity: High
VAVulnerable System Availability: High
SCSubsequent System Confidentiality: High
SISubsequent System Integrity: High
SASubsequent System Availability: High

(CVSS 4.0, ServiceNow CNA) for CVE-2026-103093; 7.1 for CVE-2026-103094; 5.3 for CVE-2026-6877

Exploited in Australia?

unknown

Patch to

Hosted customers: confirm your instance has received ServiceNow's update. Self-hosted customers and partners: apply the update ServiceNow provided under KB3228994, moving to the patch or hot fix level named in the CVE records for your family (Xanadu, Yokohama, Zurich or Australia). Until patched, review who holds the admin role, and check system tables for stored plaintext credentials and rotate any found.

vulnerabilities cloud ai