{"resourceId":"servicenow-october-2026-cve-advisory-kb3228994","versions":[{"version":"external-30eafcc53f555f3645cfb7ef7ec286c7a686e9cf8da99f7587da372d1fa0f271","resource":{"id":"servicenow-october-2026-cve-advisory-kb3228994","title":"[Security Advisory] October 2026 CVE Advisory Notification (KB3228994)","organization":"ServiceNow","sector":"Strategic partner / platform security","geography":"Global","publishedAt":"2026-10-29","publicationDate":"2026-10-29","eventDate":"2026-10-29","sourceName":"ServiceNow Now Support Portal","sourceLabel":"Vendor security advisory","sourceUrl":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure"],"finding":"On October 29, 2026 ServiceNow issued CVE-2026-103093 (critical: an admin-role user could bypass Rhino sandbox restrictions and execute code on the host OS), CVE-2026-103094 (high: plaintext passwords could persist in a system table) and CVE-2026-6877 (medium: domain separation bypass in the SR-CSM Task Plan Templates store app). ServiceNow says hosted instances were updated, it has no evidence of malicious exploitation, and lists remediated releases (e.g., Yokohama Patch 13 Hotfix 4a, Zurich Patch 10 Hotfix 3b, Australia Patch 5). Rapid7's database lists CVE-2026-103093 at CVSS 4.0 9.4, not in CISA KEV.","sledRelevance":"Direct for any state, local or education tenant, especially self-hosted or partner-managed instances and domain-separated shared-service platforms (e.g., statewide or multi-campus instances) where the domain separation bypass matters.","evidence":"Vendor advisory with affected/remediated version lists; severity per vendor CVSS 4.0 assessment, corroborated by Rapid7 entry. No independent exploit analysis yet.","architectureImplications":"Shared-service instances that rely on domain separation for tenant isolation must verify the Task Plan Templates app version; self-hosted customers must patch themselves.","governanceImplications":"Agencies should track ServiceNow batched monthly CVE releases in vulnerability management and confirm partner-managed instances are on remediated versions.","securityPrivacyImplications":"Admin-role code execution and plaintext password persistence raise privileged-access and credential exposure risks; review admin role assignments and rotate credentials if exposure is suspected.","caveats":"Vendor-authored; exploitation status is the vendor's statement; the sandbox escape requires admin role, which limits but does not eliminate risk.","streamIds":["servicenow"],"roles":{"sales":"Sales framing: security transparency is a trust conversation, not a sales objection to hide. Today's advisory gives account teams a reason to check in with public-sector customers on patch status, especially partner-managed and self-hosted instances. Position assistance as risk reduction. Do not suggest that hosted customers are fully unaffected without confirming their release and installed store applications. The advisory states no known malicious exploitation, which should be relayed accurately.","engineering":"Engineering framing: confirm each customer instance's release family and patch level against the remediated versions, and check whether the SR-CSM Task Plan Templates app is installed on domain-separated instances. Review who holds the admin role, since the critical flaw requires it. For self-hosted environments, patching is the customer's responsibility and should be scheduled urgently after testing. Corroborating severity: Rapid7 lists the sandbox escape at CVSS 4.0 9.4 and not in CISA KEV.","delivery":"Delivery framing: fold this advisory into the customer's vulnerability management runbook. Verify patch levels, document admin role holders, and plan credential rotation where plaintext password persistence may have occurred. For multi-tenant government or university instances, validate domain separation after remediation. Record evidence of completion for audit. Because the critical flaw requires the admin role, an admin-role recertification is a practical, low-cost companion task that also reduces exposure to future batches."},"roleDetails":{"sales":{"customerProblem":"Public-sector ServiceNow tenants must confirm exposure to newly disclosed platform vulnerabilities quickly.","stakeholders":["CISO","Platform owner","Managed service partner"],"discoveryQuestions":["Is your instance hosted, self-hosted or partner-managed?","Is the Task Plan Templates store app installed?","Who holds admin roles today?"],"valueHypothesis":"A rapid patch-status review reduces exposure time for critical platform flaws.","potentialEngagement":"A short patch-verification and admin-role review engagement.","unsupportedClaims":["That any customer was or was not compromised","That hosted instances need no review at all"]},"engineering":{"fit":"Applies to all ServiceNow AI Platform tenants on affected releases.","architectureIntegration":"Domain-separated shared-service instances need post-patch isolation validation.","prerequisites":["Current release and patch inventory","List of installed store apps"],"constraints":["Self-hosted customers must apply updates themselves","Xanadu or earlier families must upgrade to a supported family for CVE-2026-6877"],"security":"Restrict admin role, monitor for sandbox abuse, review stored credentials in system tables.","proofOfValue":["Confirm instance version matches a listed remediated release","Verify Task Plan Templates app version is 2.0.1, 3.0.0 or later where installed"]},"delivery":{"work":"Verify patch levels, review admin roles, validate domain separation and document remediation.","dependencies":["ServiceNow support","Managed partner","Change management window"],"ownership":"Customer CISO with platform owner executing.","skillsAdoption":"Admins need familiarity with ServiceNow patch programs and app-manager checks.","governanceCheckpoints":["Emergency change approval","Post-remediation verification sign-off"],"acceptanceCriteria":["Proposed: all production and sub-production instances on remediated versions within the customer's critical-patch SLA"],"risks":["Delayed patching on self-hosted instances","Credential exposure from persisted passwords"]}},"retrievedAt":"2026-10-29T22:28:30-05:00","enrichedAt":"2026-10-29T22:33:17-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed.","procurementImplications":"Managed-service contracts should specify patch SLAs for ServiceNow batched CVE releases.","operatingModelImplications":"Monthly batched advisories require a standing patch cadence for platform teams.","sourceVerification":{"openedUrl":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994","referenceExcerpt":"This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}