Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circumstances, by an unauthenticated attacker. The company said it deployed a security update to hosted instances and provided the update to its partners and self-hosted customers, which leaves organizations that run their

Reported facts: ServiceNow patched four security flaws in its ServiceNow AI Platform, including three with a maximum CVSS score of 10.0 that, in some circumstances, allow unauthenticated attackers to execute code and SQL on affected instances. Hosted instances have been auto-updated, while partners and self-hosted customers received updates they must apply themselves. RealGround analysis: These critical remote exploitation paths in an AI-enabled SaaS platform highlight systemic risks around AI service configuration, patch management, and supply chain dependencies. Organizations should treat AI platform vulnerabilities as core SaaS security issues, validate timely patching across all ServiceNow environments, and integrate AI-specific red teaming and SBOM-style inventory to monitor and mitigate similar high-severity flaws in their broader AI stack.