CVE-2026-0542

published 2026-02-25

CVE-2026-0542: ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an…

Priority P2 61 critical 9.2 CVSS 4.0

AV N AC H AT N PR N UI N VC H VI H VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.

ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
servicenow	servicenow_ai_platform	< Australia	Australia
servicenow	servicenow_ai_platform	< Zurich Patch 5	Zurich Patch 5
servicenow	servicenow_ai_platform	< Zurich Patch 4 Hot Fix 3b	Zurich Patch 4 Hot Fix 3b
servicenow	servicenow_ai_platform	< Yokohama Patch 12	Yokohama Patch 12
servicenow	servicenow_ai_platform	< Yokohama Patch 10 Hot Fix 1b	Yokohama Patch 10 Hot Fix 1b
servicenow	servicenow_ai_platform	< Xanadu Patch 11 Hot Fix 1a	Xanadu Patch 11 Hot Fix 1a

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-653