PatchTheCVEservicenow vulnerabilities
Recent CVEs affecting servicenow products. 5 tracked.
servicenow has 5 tracked vulnerabilities, 4 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 3. Most recent: 2026-01-12. Highest priority: CVE-2024-4879 (score 97/100).
- CVE-2025-12420 CRITICAL 9.8 UPGRADE UPGRADE A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to
- CVE-2024-8924 HIGH 7.5 DOWNGRADE ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform
- CVE-2024-8923 CRITICAL 9.8 DOWNGRADE ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform
- CVE-2024-5217 CRITICAL 9.8 EXPLOITED DOWNGRADE ServiceNow Incomplete List of Disallowed Inputs Vulnerability
- CVE-2024-4879 CRITICAL 9.8 EXPLOITED DOWNGRADE ServiceNow Improper Input Validation Vulnerability
FAQ
How do I fix servicenow vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is servicenow being exploited right now?
Yes: 2 servicenow CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.
Which servicenow CVE should I patch first?
CVE-2024-4879 currently ranks highest (97/100): ServiceNow Improper Input Validation Vulnerability.