CVE-2026-0542

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0542", "assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "state": "PUBLISHED", "assignerShortName": "SN", "dateReserved": "2025-12-30T14:27:44.742Z", "datePublished": "2026-02-25T20:35:27.303Z", "dateUpdated": "2026-02-26T15:53:05.161Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ServiceNow AI Platform", "vendor": "ServiceNow", "versions": [{"lessThan": "Australia", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Zurich Patch 5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Zurich Patch 4 Hot Fix 3b", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Yokohama Patch 12", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Yokohama Patch 10 Hot Fix 1b", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Xanadu Patch 11 Hot Fix 1a", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Lockheed Martin - Red Team"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><p>ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.&nbsp;&nbsp;&nbsp;</p></div><div></div><div><p>ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so. </p></div></div><br>"}], "value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.\u00a0\u00a0\u00a0\n\n\n\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.2, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-653", "description": "CWE-653: Improper Isolation or Compartmentalization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "shortName": "SN", "dateUpdated": "2026-02-25T20:35:27.303Z"}, "references": [{"url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2693566"}], "source": {"discovery": "UNKNOWN"}, "title": "Remote Code Execution in ServiceNow AI Platform", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T15:52:51.206570Z", "id": "CVE-2026-0542", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:53:05.161Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0542", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-26T15:52:51.206570Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:52:57.248Z"}}], "cna": {"title": "Remote Code Execution in ServiceNow AI Platform", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lockheed Martin - Red Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ServiceNow", "product": "ServiceNow AI Platform", "versions": [{"status": "affected", "version": "0", "lessThan": "Australia", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Zurich Patch 5", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Zurich Patch 4 Hot Fix 3b", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Yokohama Patch 12", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Yokohama Patch 10 Hot Fix 1b", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "Xanadu Patch 11 Hot Fix 1a", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2693566"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.\u00a0\u00a0\u00a0\n\n\n\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.", "supportingMedia": [{"type": "text/html", "value": "<div><div><p>ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.&nbsp;&nbsp;&nbsp;</p></div><div></div><div><p>ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so. </p></div></div><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-653", "description": "CWE-653: Improper Isolation or Compartmentalization"}]}], "providerMetadata": {"orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "shortName": "SN", "dateUpdated": "2026-02-25T20:35:27.303Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0542", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:53:05.161Z", "dateReserved": "2025-12-30T14:27:44.742Z", "assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375", "datePublished": "2026-02-25T20:35:27.303Z", "assignerShortName": "SN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ServiceNow AI Platform", "vendor": "ServiceNow", "versions": [{"lessThan": "Australia", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Zurich Patch 5", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Zurich Patch 4 Hot Fix 3b", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Yokohama Patch 12", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Yokohama Patch 10 Hot Fix 1b", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "Xanadu Patch 11 Hot Fix 1a", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@servicenow.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.\u00a0\u00a0\u00a0\n\n\n\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so."}, {"lang": "es", "value": "ServiceNow ha abordado una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo que fue identificada en la plataforma de IA de ServiceNow. Esta vulnerabilidad podr\u00eda permitir a un usuario no autenticado, en ciertas circunstancias, ejecutar c\u00f3digo dentro del sandbox de ServiceNow.\n\nServiceNow abord\u00f3 esta vulnerabilidad desplegando una actualizaci\u00f3n de seguridad en las instancias alojadas. Las actualizaciones de seguridad relevantes tambi\u00e9n se han proporcionado a los clientes y socios de ServiceNow con autoalojamiento. Adem\u00e1s, la vulnerabilidad se aborda en los parches y hot fixes listados. Si bien no tenemos conocimiento actual de explotaci\u00f3n contra instancias de clientes, recomendamos a los clientes aplicar r\u00e1pidamente las actualizaciones apropiadas o actualizar si a\u00fan no lo han hecho."}], "id": "CVE-2026-0542", "lastModified": "2026-06-17T10:10:55.040", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@servicenow.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0542", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T15:52:51.206570Z", "version": "2.0.3"}}]}, "published": "2026-02-25T21:16:36.147", "references": [{"source": "psirt@servicenow.com", "url": "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2693566"}], "sourceIdentifier": "psirt@servicenow.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-653"}], "source": "psirt@servicenow.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Australia)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Zurich Patch 5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Zurich Patch 4 Hot Fix 3b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Yokohama Patch 12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Yokohama Patch 10 Hot Fix 1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,Xanadu Patch 11 Hot Fix 1a)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ServiceNow AI Platform", "source": "cna", "vendor": "ServiceNow"}, "product": "servicenow_ai_platform", "vendor": "servicenow"}], "analysis": {"en": {"generated_at": "2026-04-18T10:35:14.875513+00:00", "value": {"mitigation_remediation": ["Deploy the ServiceNow\u2011issued security update to all hosted AI Platform instances.", "Apply the posted patches and hot fixes to self\u2011hosted installations as described in the vendor support article.", "If patching cannot be performed immediately, isolate the AI platform sandbox and block unauthenticated API or interface access until the update is applied."], "summary": {"action": "Apply Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected product is ServiceNow AI Platform, encompassing both ServiceNow\u2011hosted instances and self\u2011hosted deployments. No explicit version range is specified, so all current releases of the AI Platform should be verified against the published security updates.", "description_and_impact": "The vulnerability is located in the ServiceNow AI Platform and permits an attacker, without authentication, to execute arbitrary code within the ServiceNow sandbox. This is due to improper input handling identified as CWE\u2011653. The ability to run code with sandbox privileges could result in compromise of the sandbox and unauthorized access to instance data and services.", "risk_and_exploitability": "The CVSS score of 9.2 reflects a critical severity. The EPSS score of less than 1 percent indicates a low likelihood of active exploitation currently, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote, unauthenticated, and accessible from any network point that can reach the AI platform. Attackers would need to supply specially crafted input to trigger the vulnerability."}}}}, "created": "2026-02-26T13:14:37.503891+00:00", "updated": "2026-04-18T10:45:43.649615+00:00", "vendors": ["servicenow", "servicenow$PRODUCT$servicenow_ai_platform"]}