CVE-2024-8923— Sandbox Escape in Now Platform
Quick assessment
Affected
ServiceNow Now Platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ServiceNow Now Platform是美国ServiceNow公司的一个基于云的平台，使用 AI 和机器学习来自动化和优化整个企业的工作。 ServiceNow Now Platform存在安全漏洞，该漏洞源于输入验证不足，这可能使未认证用户能够远程执行代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-8923
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sandbox Escape in Now Platform
Source: CVE Program / CVE List V5
Vulnerability Description
ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow deployed an update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. Further, the vulnerability is addressed in the listed patches and hot fixes.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
ServiceNow Now Platform 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ServiceNow Now Platform是美国ServiceNow公司的一个基于云的平台，使用 AI 和机器学习来自动化和优化整个企业的工作。 ServiceNow Now Platform存在安全漏洞，该漏洞源于输入验证不足，这可能使未认证用户能够远程执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ServiceNow | Now Platform | 0 ~ Vancouver Patch 9 Hot Fix 2a | - |
|
II. Public POCs for CVE-2024-8923
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-8923
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Now Platform
-
CVE-2025-3648
Data Inference in Now Platform via Conditional ACLs -
CVE-2025-0337
Authorization bypass in Now Platform -
CVE-2024-5890
HTML Injection in the Assessment plugin -
CVE-2024-8924
Unauthenticated Blind SQL Injection in Core Platform -
CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
Same vendor: ServiceNow
-
CVE-2026-86860
Unauthenticated Sensitive Data Disclosure in ServiceNow AI P -
CVE-2026-86859
Unauthenticated Arbitrary Record Disclosure in ServiceNow AI -
CVE-2026-13016
Unauthenticated SQL Injection in ServiceNow AI Platform -
CVE-2026-86858
Unauthenticated Privilege Escalation via GraphQL in ServiceN -
CVE-2026-86857
Authorization Bypass in ServiceNow AI Platform
Same weakness: CWE-94
-
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images -
CVE-2026-105329
TallCMS PluginManager ThemeManager.php code injection -
CVE-2026-105226
osCommerce osCommerce2 Newsletter Management newsletters.php -
CVE-2026-105225
osCommerce osCommerce2 Payment payment.php include code inje -
CVE-2026-105135
InternLM MindSearch Planner Agent graph.py ExecutionAction.r
V. Comments for CVE-2024-8923
No comments yet