Loading story…
MDSec found that a compromised ServiceNow tenant can provide a high-impact route into connected enterprise infrastructure, including on-premises networks reached through Management, Instrumentation, and Discovery (MID) Servers. During red-team engagements, researchers gained initial access through hijacked user sessions, exposed MID Server configuration credentials, and simulated exploitation of major ServiceNow zero-days, then abused excessive platform privileges to expand control.
The assessment identified at least 24 ServiceNow roles with potential privilege-escalation paths, including catalog_admin, import_admin, and sn_cmdb_editor; action_designer could serve as an intermediary in escalation chains. MDSec also demonstrated persistence, evasion, credential access, and command execution through MID Servers, and developed SnowFall, a proof-of-concept fileless C2 framework using scheduled ServiceNow jobs and Glide scripts. The firm reported immature monitoring, incident-response, and containment capabilities across assessed organizations, leaving ServiceNow deployments attractive targets for enterprise compromise.
Get the actors, campaigns, and ATT&CK mapping behind it.
10 events from the most recent confirmed update back to the earliest known activity.
MDSec reported that attackers could evade ServiceNow detections through role inheritance, audit-field manipulation, brief privileged-role assignments, and deletion of activity records. It identified login, role, flow, script-execution, and transaction-history records as potential evidence of malicious activity.
MDSec reported that MID Server configuration and credential-decryption functions could expose Windows discovery credentials, SSH credentials, and API keys. It described onward movement from a compromised MID Server through discovery credentials to SCCM or comparable privileged infrastructure, including across otherwise separated Active Directory forests connected to one tenant.
MDSec demonstrated that a compromised ServiceNow tenant could execute code on MID Servers by uploading custom JAR plugins through the ECC Queue, and could send operating-system commands to a specific MID Server using ECC Queue records.
MDSec reported that ServiceNow tables and attachments exposed login history, incident data, red-team reports, and detection-triage information. In one engagement, a ServiceNow CyberArk REST Message enabled retrieval of passwords from an accessible CyberArk Safe, including a tenant break-glass administrator account.
MDSec demonstrated persistence through modified business rules and scheduled jobs that could recreate and elevate a backdoor user. It also described SnowFall, a fileless command-and-control framework using scheduled jobs to retrieve, execute, and return Glide-script commands through an external redirector.
MDSec identified at least 24 distinct ServiceNow roles that could be leveraged for privilege escalation, including catalog_admin, import_admin, and sn_cmdb_editor. Across three engagements, it found more than 10,000 users assigned sn_cmdb_editor.
MDSec reported that an import_admin MID service account could use the ServiceNow REST API to create and trigger transform maps containing elevated scripts. The technique could remove the account's web_service_access_only restriction, grant an intermediary role, and enable interactive logon.
During another engagement, MDSec found a ServiceNow config.xml file on a file share containing credentials for a MID Server account with the import_admin role.
MDSec abused catalog_admin's inherited user_criteria_admin privileges to run elevated Glide scripts, assigned action_designer to the compromised HR user, and used Workflow Studio to obtain administrative privileges.
In one engagement, MDSec phished an HR employee, extracted the employee's ServiceNow session cookie, and found the account had the catalog_admin role.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ServiceNow customers were urged to patch multiple **critical remote code execution** vulnerabilities after reports that flaws in the platform were being **actively exploited**. One set of bugs affected core ServiceNow deployments and was serious enough to trigger immediate warnings from security researchers and industry media, highlighting the risk of unauthenticated or low-friction compromise in widely used enterprise workflow environments. A separate report later identified another **critical RCE vulnerability** in the **ServiceNow AI Platform**, expanding concern from the core platform to newer AI-enabled components. Together, the disclosures indicate that attackers have had viable paths to execute code against ServiceNow environments across both traditional and AI-related services, raising the stakes for organizations that use the platform for IT, HR, security, and business process automation.
Jun 29, 2026
Bishop Fox disclosed widespread **public data exposure** risks in ServiceNow environments caused by misconfigured access controls and portal settings rather than a single platform zero-day. In 166 authorized assessments, the firm found that **31% of instances** exposed data to unauthenticated users, with positive findings affecting roughly three-quarters of the organizations represented in those cases. The exposures were observed on **Service Portal widgets** and the **Table REST API**, where public sessions could sometimes retrieve full backend records or at least confirm record counts without credentials. Researchers said the stock **ticket-attachments** widget was a frequent source of exposure, leaking metadata tied to internal business processes and potentially revealing sensitive operational details. To help defenders identify these weaknesses, Bishop Fox released **Snowpick**, an open-source Go-based scanner that tests public ServiceNow surfaces from an unauthenticated perspective, distinguishes full-record exposure from count-only leaks, and produces bounded evidence for remediation. The findings reinforce that organizations must validate widget behavior, table access, and ACL enforcement independently on any publicly reachable ServiceNow instance.
Jul 24, 2026
ServiceNow disclosed and remediated **CVE-2026-6875**, a critical sandbox escape in its AI Platform that can allow **unauthenticated remote code execution** in certain circumstances. The vulnerability affects both hosted and self-hosted ServiceNow environments, carries a **CVSS 4.0 score of 9.5**, and was published in advisory `KB3137947`. ServiceNow said it has already deployed security updates to hosted instances and issued patched family releases and updates for self-hosted customers and partners. The company said it is **not currently aware of active exploitation**, but warned that successful compromise could let attackers execute code within the ServiceNow platform, disrupt workflows, access sensitive data, modify records, and enable follow-on malicious activity. To reduce near-term exploit risk, ServiceNow limited public technical details while directing customers to promptly apply the relevant updates or upgrade to patched releases, including fixes for the **Brazil, Australia, Zurich, and Yokohama** release families.
Jul 21, 2026