Loading story…
ServiceNow released security updates for the Now Platform to fix CVE-2025-3648, a high-severity vulnerability with a CVSS score of 8.2 that researchers at Varonis dubbed "Count(er) Strike." The flaw stems from a logical error in Access Control List (ACL) rule evaluation, allowing attackers to abuse range query requests to infer or retrieve data they should not be able to access. Both unauthenticated and authenticated attackers could exploit the issue under certain conditions.
The vulnerability affects ServiceNow Now Platform versions older than Xanadu and Yokohama and can expose sensitive information, including credentials, when specific ACL configurations are present. ServiceNow advised customers to upgrade affected instances to Xanadu or Yokohama and to review mitigation guidance in knowledge base articles KB2256712 and KB2046494 to reduce the risk of unauthorized data access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
ServiceNow released security updates for its Now Platform to fix CVE-2025-3648, a high-severity ACL rule evaluation flaw dubbed "Count(er) Strike." The vulnerability could be exploited via range query requests by unauthenticated or authenticated attackers to access sensitive data on affected versions older than Xanadu and Yokohama.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ServiceNow patched a **critical unauthenticated remote code execution (RCE)** vulnerability in the *ServiceNow AI Platform* tracked as **CVE-2026-0542**. The flaw can allow an unauthenticated attacker, under certain conditions, to execute code within the **ServiceNow Sandbox**—a restricted environment intended to isolate untrusted code—creating risk of broader instance compromise, including potential data theft and workflow manipulation. Public technical details were limited, but the issue was characterized as remotely reachable (typically over HTTPS) and high impact, with reporting citing **critical severity (CVSS 9.8)**. ServiceNow’s advisory (**KB2693566**) states the company deployed security updates to affected **hosted customer instances** and also made updates available to **self-hosted customers and partners** via patches/hotfixes. As of the advisory information reflected in CVE tracking, ServiceNow reported it was **not aware of active exploitation against customer instances**, but recommended customers apply the relevant updates or upgrade promptly to mitigate the risk from an unauthenticated RCE path into the sandboxed execution environment.
Jun 29, 2026
ServiceNow disclosed and remediated **CVE-2026-6875**, a critical sandbox escape in its AI Platform that can allow **unauthenticated remote code execution** in certain circumstances. The vulnerability affects both hosted and self-hosted ServiceNow environments, carries a **CVSS 4.0 score of 9.5**, and was published in advisory `KB3137947`. ServiceNow said it has already deployed security updates to hosted instances and issued patched family releases and updates for self-hosted customers and partners. The company said it is **not currently aware of active exploitation**, but warned that successful compromise could let attackers execute code within the ServiceNow platform, disrupt workflows, access sensitive data, modify records, and enable follow-on malicious activity. To reduce near-term exploit risk, ServiceNow limited public technical details while directing customers to promptly apply the relevant updates or upgrade to patched releases, including fixes for the **Brazil, Australia, Zurich, and Yokohama** release families.
Jul 21, 2026
ServiceNow customers were urged to patch multiple **critical remote code execution** vulnerabilities after reports that flaws in the platform were being **actively exploited**. One set of bugs affected core ServiceNow deployments and was serious enough to trigger immediate warnings from security researchers and industry media, highlighting the risk of unauthenticated or low-friction compromise in widely used enterprise workflow environments. A separate report later identified another **critical RCE vulnerability** in the **ServiceNow AI Platform**, expanding concern from the core platform to newer AI-enabled components. Together, the disclosures indicate that attackers have had viable paths to execute code against ServiceNow environments across both traditional and AI-related services, raising the stakes for organizations that use the platform for IT, HR, security, and business process automation.
Jun 29, 2026