Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using self-hosted ServiceNow AI Platform
Incident: Discovery of multiple critical vulnerabilities allowing unauthenticated remote code execution and SQL injection in ServiceNow.
Impact: Potential for complete system compromise, including full loss of data confidentiality, integrity, and availability.
Attacker: Unidentified threat actors
Analysis: ServiceNow has patched four severe vulnerabilities, including three with perfect 10.0 CVSS scores. These flaws allow for remote code execution, SQL injection, and privilege escalation without requiring any user credentials or interaction. While active exploitation of these specific bugs hasn’t been confirmed, the platform’s recent history of wild exploitation underscores the urgent need for updates.
Recommendations: Immediately update all self-hosted ServiceNow instances to the latest patched version; Verify the application of security updates specifically for the AI Platform components; Monitor instance logs for unusual GraphQL or SQL queries that may indicate exploitation attempts
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source