ServiceNow Now Platform Vulnerabilities: CVEs, CISA KEV & Security Advisories

This page aggregates every publicly disclosed vulnerability (CVE) affecting ServiceNow Now Platform, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Affected versions and CVEs

Browse every ServiceNow Now Platform version named in a CVE, then pick one to see only the CVEs that affect it.

Fixed in

Vancouver Patch 105 CVEs
Utah Patch 10 Hot Fix 33 CVEs
Utah Patch 10a Hot Fix 23 CVEs
Vancouver Patch 6 Hot Fix 23 CVEs
Vancouver Patch 7 Hot Fix 3b3 CVEs
Vancouver Patch 8 Hot Fix 43 CVEs
Washington DC Patch 2 Hot Fix 23 CVEs
Washington DC Patch 43 CVEs
Patch 92 CVEs
Utah Patch 10b Hot Fix 12 CVEs
Vancouver Patch 92 CVEs
Vancouver Patch 9 Hot Fix 12 CVEs
Washington DC Patch 1 Hot Fix 3b2 CVEs
Washington DC Patch 3 Hot Fix 22 CVEs
Washington DC Patch 52 CVEs
GA1 CVE
Patch 10 Hot Fix 11 CVE
Patch 10 Hot Fix 8b1 CVE
Patch 10 Hotfix 10b1 CVE
Patch 10 Hotfix 11b1 CVE
Patch 10 Hotfix 2b1 CVE
Patch 10 Hotfix 3b1 CVE
Patch 1a1 CVE
Patch 21 CVE
Patch 41 CVE
Patch 71 CVE
Patch 7b1 CVE
Tokyo Patch 11 CVE
Utah General Availability (GA)1 CVE
Utah Patch 10b Hot Fix 31 CVE
Utah Patch 8 Hot Fix 11 CVE
Vancouver Patch 10 Hot Fix 21 CVE
Vancouver Patch 8 Hot Fix 51 CVE
Vancouver Patch 9 Hot Fix 2a1 CVE
Vancouver Patch 9 Hot Fix 3b1 CVE
Washington DC Early Access1 CVE
Washington DC Patch 1 Hot Fix 2b1 CVE
Washington DC Patch 3 Hot Fix 11 CVE
Washington DC Patch 4 Hot Fix 1a1 CVE
Washington DC Patch 4 Hot Fix 2b1 CVE
Washington DC Patch 5 Hot Fix 61 CVE
Washington DC Patch 6 Hot Fix 11 CVE
Washington DC Patch 71 CVE
Washington DC Patch 91 CVE
Xanadu GA Release1 CVE
Xanadu Patch 11 CVE
Xanadu Patch 41 CVE
Yokohama1 CVE

Default status

All versions1 CVE

Find a version

11 CVEs

Sort

Data Inference in Now Platform via Conditional ACLs
CVE-2025-3648CWE-1220
High · CVSS 8.2
EPSS 0.3% (54th pct)2025-07-08
Authorization bypass in Now Platform
CVE-2025-0337
Patch
CWE-639
High · CVSS 7.1
EPSS 0.0% (8th pct)2025-03-06
Medium vulnerability · 2024-12-02
CVE-2024-5890
Patch
CWE-79
Medium · CVSS 5.1
EPSS 0.4% (60th pct)2024-12-02
High vulnerability · 2024-10-29
CVE-2024-8924
Patch
CWE-89
High · CVSS 8.7
EPSS 0.6% (70th pct)2024-10-29
Critical vulnerability · 2024-10-29
CVE-2024-8923
Patch
CWE-94
Critical · CVSS 9.8
EPSS 0.9% (75th pct)2024-10-29
Incomplete Input Validation in GlideExpression Script
CVE-2024-5217
CISA KEV
Public exploit
Patch
CWE-184
Added to CISA KEV 2024-07-29
Critical · CVSS 9.2
EPSS 94.1% (100th pct)2024-07-10
Incomplete Input Validation in SecurelyAccess API
CVE-2024-5178
Patch
CWE-184
Medium · CVSS 6.9
EPSS 1.9% (84th pct)2024-07-10
Jelly Template Injection Vulnerability in ServiceNow UI Macros
CVE-2024-4879
CISA KEV
Public exploit
Patch
CWE-1287
Added to CISA KEV 2024-07-29
Critical · CVSS 9.3
EPSS 94.3% (100th pct)2024-07-10
Critical vulnerability · 2023-06-13
CVE-2022-43684
Public exploit
Patch
CWE-200
Critical · CVSS 9.9
EPSS 0.2% (44th pct)2023-06-13
Medium vulnerability · 2023-04-17
CVE-2022-46389
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.7% (72th pct)2023-04-17
Medium vulnerability · 2023-04-10
CVE-2022-39048
Patch
CWE-79
Medium · CVSS 6.1
EPSS 17.0% (95th pct)2023-04-10

ServiceNow Now Platform Vulnerabilities

Overview

Severity and exploitation

Affected versions and CVEs

Fixed in

Default status

Common weakness types

Disclosure activity by year

Other ServiceNow products

Frequently asked questions

How many CVEs does ServiceNow Now Platform have?

How many ServiceNow Now Platform CVEs are in CISA KEV?

Are there public exploits for ServiceNow Now Platform vulnerabilities?

Which versions of ServiceNow Now Platform are affected?

What are the most common weakness types in ServiceNow Now Platform CVEs?

How many critical ServiceNow Now Platform vulnerabilities are there?

What is the average severity of ServiceNow Now Platform CVEs?

References

Track ServiceNow Now Platform vulnerabilities