According to Security NEXT, on October 29, 2026, ServiceNow disclosed two vulnerabilities in AI Platform and one in Task Plan Templates, stating that updates released since September had addressed them [1]. CVE-2026-103093 allows an authenticated user with administrator privileges to bypass the Rhino sandbox and execute arbitrary code on the host operating system, rated 9.4 under CVSS v4.0 by the vendor [1]. Another flaw, CVE-2026-103094, could store passwords in cleartext in system tables and was rated 7.1 by the vendor, with no exploitation confirmed at the time of disclosure [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
ServiceNow Discloses Three Vulnerabilities in AI Platform and Related Products, Patched via Updates
1 min read
- Disclosed
- Oct 30, 2026
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- [1]
- EPSS (chance of exploitation in 30 days)
- 0.4%, higher than 37% of CVEs
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology
What to do nowOur advice
Another flaw, CVE-2026-103094, could store passwords in cleartext in system tables and was rated 7.1 by the vendor, with no exploitation confirmed at the time of disclosure [1].
Timeline
- Security NEXT publishes report (date only; timestamp is a placeholder)[1]
Technical details
Verified Source Summary
On October 29, 2026, ServiceNow disclosed two vulnerabilities in AI Platform and one in Task Plan Templates, stating that updates released since September had addressed them [1].
CVE-2026-103093 allows an authenticated user with administrator privileges to bypass the Rhino sandbox and execute arbitrary code on the host operating system, rated 9.4 under CVSS v4.0 by the vendor [1].
Another flaw, CVE-2026-103094, could store passwords in cleartext in system tables and was rated 7.1 by the vendor, with no exploitation confirmed at the time of disclosure [1].
References
Media1
- [1]
“業務管理プラットフォーム「ServiceNow AI Platform」に複数の脆弱性が判明した。9月以降のアップデートで対応したという。”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.