Unauthenticated RCE in ServiceNow Now Platform

Successful exploitation can result in unauthenticated remote code execution in the context of the ServiceNow Now Platform. This creates a high-impact compromise scenario affecting confidentiality, integrity, and availability, including the ability to run unauthorized logic, access or manipulate platform data and workflows, and potentially abuse connected enterprise integrations and downstream systems reachable through the platform.

If immediate patching is not possible, reduce exposure of vulnerable instances as much as operationally feasible, especially any externally reachable access paths. Increase monitoring and detection for unusual unauthenticated requests, unexpected workflow or code execution, anomalous administrative actions, and signs of abuse involving platform integrations. Restrict access to affected functionality where possible and enforce least privilege across integrations and administrative roles until the patched release is deployed.

Apply the vendor-provided fixed release for the affected ServiceNow family. Reported fixed versions include Xanadu General Availability, Washington DC Patch 4 Hot Fix 1a or Washington DC Patch 5, and Vancouver Patch 9 Hot Fix 2a or Vancouver Patch 10, as applicable to the deployment. Hosted instances should be verified to have received the vendor-deployed update, and self-hosted or partner-managed deployments should be upgraded to the appropriate patched build without delay. Because patching does not remediate prior compromise, post-update review for suspicious activity is also warranted.