Loading story…
Threat actors exploited critical ServiceNow Now Platform vulnerabilities in a global reconnaissance campaign, with Imperva observing exploitation attempts against more than 6,000 sites across multiple industries, particularly financial services. CVE-2024-4879 and CVE-2024-5217, rated CVSS v4 9.3 and 9.2 respectively, enable unauthenticated remote code execution; CVE-2024-5178 allows administrative users to access sensitive server files without authorization. Imperva reported that the flaws could be chained to execute code and access instance data. Affected releases include Washington D.C., Vancouver, and Utah.
Resecurity observed mass scanning, vulnerability testing, retrieval of database configuration information, and extraction of user records containing password hashes. Targets included an energy corporation, a data-center organization, a Middle Eastern government agency, and a software development company. Imperva also identified automated attacks against login pages, with payloads testing code execution or attempting to reveal database credentials. ServiceNow released patches and hotfixes; organizations should verify remediation, review access logs for exploitation, and investigate possible credential exposure. Resecurity characterized its observed activity as limited and contained, but warned that exposed information could support further targeting.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Resecurity characterized the malicious activity it identified during the exposure window as limited and reported that ServiceNow contained it in a timely manner.
Symantec, part of Broadcom, and other cybersecurity vendors added detection signatures for attempts to exploit the ServiceNow vulnerabilities.
During one week of monitoring beginning with the vulnerability release, Resecurity observed targeting of an energy corporation, a data-center organization, a Middle Eastern government agency, and a software development company. Observed exploitation stages attempted to read glide.db.properties for database connection details and queried sys_user to extract usernames, password values, and metadata; most collected passwords were hashed, and attackers failed to crack most hashes.
Imperva observed automated exploitation attempts against more than 6,000 sites across multiple industries, particularly financial services. Payloads targeted ServiceNow login pages to test remote code execution or attempt to display database usernames and passwords; the report did not establish that all targeted sites were compromised.
After vulnerability information became public, multiple threat actors began scanning for vulnerable ServiceNow instances. Resecurity acquired two scanning host lists and observed login-endpoint requests that injected a calculation and checked its result to test exploitability.
A proof of concept for CVE-2024-4879 became publicly available, which Resecurity identified as a catalyst for exploitation. Imperva reported that this was the only vulnerability in the three-flaw chain with an available proof of concept at the time of its report.
ServiceNow released fixes for the vulnerabilities, documented in knowledge-base articles KB1645154, KB1648313, and KB1648312.
ServiceNow disclosed three vulnerabilities affecting releases including Washington D.C., Vancouver, and Utah. Resecurity described CVE-2024-4879 and CVE-2024-5217 as unauthenticated remote code execution flaws and CVE-2024-5178 as allowing administrative users unauthorized access to sensitive server files.
Assetnote researchers discovered CVE-2024-4879, CVE-2024-5217, and CVE-2024-5178 affecting ServiceNow's Now Platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ServiceNow customers were urged to patch multiple **critical remote code execution** vulnerabilities after reports that flaws in the platform were being **actively exploited**. One set of bugs affected core ServiceNow deployments and was serious enough to trigger immediate warnings from security researchers and industry media, highlighting the risk of unauthenticated or low-friction compromise in widely used enterprise workflow environments. A separate report later identified another **critical RCE vulnerability** in the **ServiceNow AI Platform**, expanding concern from the core platform to newer AI-enabled components. Together, the disclosures indicate that attackers have had viable paths to execute code against ServiceNow environments across both traditional and AI-related services, raising the stakes for organizations that use the platform for IT, HR, security, and business process automation.
Jun 29, 2026
ServiceNow disclosed and remediated **CVE-2026-6875**, a critical sandbox escape in its AI Platform that can allow **unauthenticated remote code execution** in certain circumstances. The vulnerability affects both hosted and self-hosted ServiceNow environments, carries a **CVSS 4.0 score of 9.5**, and was published in advisory `KB3137947`. ServiceNow said it has already deployed security updates to hosted instances and issued patched family releases and updates for self-hosted customers and partners. The company said it is **not currently aware of active exploitation**, but warned that successful compromise could let attackers execute code within the ServiceNow platform, disrupt workflows, access sensitive data, modify records, and enable follow-on malicious activity. To reduce near-term exploit risk, ServiceNow limited public technical details while directing customers to promptly apply the relevant updates or upgrade to patched releases, including fixes for the **Brazil, Australia, Zurich, and Yokohama** release families.
Jul 21, 2026
ServiceNow patched a **critical unauthenticated remote code execution (RCE)** vulnerability in the *ServiceNow AI Platform* tracked as **CVE-2026-0542**. The flaw can allow an unauthenticated attacker, under certain conditions, to execute code within the **ServiceNow Sandbox**—a restricted environment intended to isolate untrusted code—creating risk of broader instance compromise, including potential data theft and workflow manipulation. Public technical details were limited, but the issue was characterized as remotely reachable (typically over HTTPS) and high impact, with reporting citing **critical severity (CVSS 9.8)**. ServiceNow’s advisory (**KB2693566**) states the company deployed security updates to affected **hosted customer instances** and also made updates available to **self-hosted customers and partners** via patches/hotfixes. As of the advisory information reflected in CVE tracking, ServiceNow reported it was **not aware of active exploitation against customer instances**, but recommended customers apply the relevant updates or upgrade promptly to mitigate the risk from an unauthenticated RCE path into the sandboxed execution environment.
Jun 29, 2026