CVE-2026-0542

criticalpriority · track · 10EPSS 0.007 · 51 %ileexploit · PoCDEEU

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.66% (51st) EPSS

CVSS 9.2 · critical

Is it mine?

7 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · cert_bund

EPSS · scored 2026-10-23

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.

cvss

Technical severity, 0–10. One row per scoring source.

9.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.2–9.2

v4.09.2criticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.09.2criticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · psirt@servicenow.com

v4.08.2highCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-653US

exploits (1)

Public proof-of-concept and weaponised exploit code.

HORKimhab/CVE-2026-0542CVE-2026-0542 - Draft - ServiceNowPoC · poc_in_github

affected products (7)

Products and version ranges known to be affected.

ServiceNow AI Platformall versionscert_bundDEcpe:/a:servicenow:ai_platform:-
Servicenow ServiceNow AI Platform0 → Australiaenisa_euvdEU
Servicenow ServiceNow AI Platform0 → Xanadu Patch 11 Hot Fix 1aenisa_euvdEU
Servicenow ServiceNow AI Platform0 → Yokohama Patch 10 Hot Fix 1benisa_euvdEU
Servicenow ServiceNow AI Platform0 → Yokohama Patch 12enisa_euvdEU
Servicenow ServiceNow AI Platform0 → Zurich Patch 4 Hot Fix 3benisa_euvdEU
Servicenow ServiceNow AI Platform0 → Zurich Patch 5enisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0540ServiceNow AI Platform: Schwachstelle ermöglicht CodeausführungDeutsch2026-02-25csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ServiceNow AI Platform ausnutzen, um beliebigen Programmcode auszuführen.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund NVD CVE.org MITRE

published 2026-02-25modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan