From the ServiceNow edition of October 29, 2026
[Security Advisory] October 2026 CVE Advisory Notification (KB3228994)
ServiceNow · Strategic partner / platform security · Global
- Publisher
- ServiceNow Now Support Portal
- Original publication
- 2026-10-29
- Source retrieved
- 2026-10-30
- Event date
- 2026-10-29
What happened
On October 29, 2026 ServiceNow issued CVE-2026-103093 (critical: an admin-role user could bypass Rhino sandbox restrictions and execute code on the host OS), CVE-2026-103094 (high: plaintext passwords could persist in a system table) and CVE-2026-6877 (medium: domain separation bypass in the SR-CSM Task Plan Templates store app). ServiceNow says hosted instances were updated, it has no evidence of malicious exploitation, and lists remediated releases (e.g., Yokohama Patch 13 Hotfix 4a, Zurich Patch 10 Hotfix 3b, Australia Patch 5). Rapid7's database lists CVE-2026-103093 at CVSS 4.0 9.4, not in CISA KEV.
Why it matters
Direct for any state, local or education tenant, especially self-hosted or partner-managed instances and domain-separated shared-service platforms (e.g., statewide or multi-campus instances) where the domain separation bypass matters.
Evidence and measured results
Vendor advisory with affected/remediated version lists; severity per vendor CVSS 4.0 assessment, corroborated by Rapid7 entry. No independent exploit analysis yet.
Limitations and uncertainty
Vendor-authored; exploitation status is the vendor's statement; the sandbox escape requires admin role, which limits but does not eliminate risk.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-29; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public-sector ServiceNow tenants must confirm exposure to newly disclosed platform vulnerabilities quickly.
- Stakeholders
- CISO
- Platform owner
- Managed service partner
- Discovery questions
- Is your instance hosted, self-hosted or partner-managed?
- Is the Task Plan Templates store app installed?
- Who holds admin roles today?
- Value hypothesis
- A rapid patch-status review reduces exposure time for critical platform flaws.
- Potential engagement
- A short patch-verification and admin-role review engagement.
- Unsupported claims
- That any customer was or was not compromised
- That hosted instances need no review at all
Pre-sales engineering
Role takeaway
- Fit
- Applies to all ServiceNow AI Platform tenants on affected releases.
- Architecture and integration
- Domain-separated shared-service instances need post-patch isolation validation.
- Prerequisites
- Current release and patch inventory
- List of installed store apps
- Constraints
- Self-hosted customers must apply updates themselves
- Xanadu or earlier families must upgrade to a supported family for CVE-2026-6877
- Security
- Restrict admin role, monitor for sandbox abuse, review stored credentials in system tables.
- Proof of value
- Confirm instance version matches a listed remediated release
- Verify Task Plan Templates app version is 2.0.1, 3.0.0 or later where installed
Delivery
Role takeaway
- Work
- Verify patch levels, review admin roles, validate domain separation and document remediation.
- Dependencies
- ServiceNow support
- Managed partner
- Change management window
- Ownership
- Customer CISO with platform owner executing.
- Skills and adoption
- Admins need familiarity with ServiceNow patch programs and app-manager checks.
- Governance checkpoints
- Emergency change approval
- Post-remediation verification sign-off
- Acceptance criteria
- Proposed: all production and sub-production instances on remediated versions within the customer's critical-patch SLA
- Risks
- Delayed patching on self-hosted instances
- Credential exposure from persisted passwords
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Shared-service instances that rely on domain separation for tenant isolation must verify the Task Plan Templates app version; self-hosted customers must patch themselves.
Governance
Who approves, reviews and stays accountable for outcomes?
Agencies should track ServiceNow batched monthly CVE releases in vulnerability management and confirm partner-managed instances are on remediated versions.
Security and privacy
What data, permissions and controls need testing?
Admin-role code execution and plaintext password persistence raise privileged-access and credential exposure risks; review admin role assignments and rotate credentials if exposure is suspected.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Not addressed.
Procurement
What should contracts, pricing and exit terms secure?
Managed-service contracts should specify patch SLAs for ServiceNow batched CVE releases.
Operating model
Which teams own the service once it runs?
Monthly batched advisories require a standing patch cadence for platform teams.
Publication history
- 2026-10-29ServiceNow · Issue 017 resources
Stable resource ID: servicenow-october-2026-cve-advisory-kb3228994