CVE-2026-0542

Remote Code Execution in ServiceNow AI Platform

State: Published
Severity: 9.2 Critical
Published: Feb 25, 2026
Updated: Feb 26, 2026
Reserved: Dec 30, 2025

Description

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox.

ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	SN

Weaknesses

CWE-653 Improper Isolation or Compartmentalization

Affected Products

Product	Versions
ServiceNow AI PlatformServiceNow	before AustraliaAffected before Zurich Patch 5Affected before Zurich Patch 4 Hot Fix 3bAffected before Yokohama Patch 12Affected before Yokohama Patch 10 Hot Fix 1bAffected before Xanadu Patch 11 Hot Fix 1aAffected

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2693566

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.