CVE-2025-3089

published 2025-08-12

CVE-2025-3089: ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low…

Priority P4 31 medium 5.3 CVSS 4.0

AV N AC L AT N PR L UI N VC N VI L VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
servicenow	servicenow_ai_platform	>= Aspen < Washington DC Patch 10 Hot Fix 2a	Washington DC Patch 10 Hot Fix 2a
servicenow	servicenow_ai_platform	>= Aspen < Xanadu Patch 7a	Xanadu Patch 7a
servicenow	servicenow_ai_platform	>= Aspen < Xanadu Patch 8	Xanadu Patch 8
servicenow	servicenow_ai_platform	>= Aspen < Yokohama Patch 1a	Yokohama Patch 1a
servicenow	servicenow_ai_platform	>= Aspen < Yokohama Patch 2	Yokohama Patch 2
servicenow	servicenow_ai_platform	>= Aspen < Zurich (EA)	Zurich (EA)

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-639