ServiceNow AI Platform Patches Critical RCE Vulnerability CVE-2026-0542
2 min. read 
Published on
ServiceNow fixed CVE-2026-0542, a critical remote code execution flaw in its AI Platform sandbox. Attackers could run malicious code without authentication over HTTPS. The company deployed patches starting January 6, 2026, to all affected instances.
This vulnerability hit the AI Platform’s web, API, and automation modules. The sandbox meant to isolate untrusted code failed under specific conditions. Enterprises faced risks of system compromise, data theft, or workflow changes. ServiceNow rates it CVSS 9.8 critical.
No evidence shows active attacks at patch time. Still, unauthenticated RCE draws threat actors fast. Organizations must update now to block exploits. Self-hosted users got hotfixes too.
Vulnerability Breakdown
CVE-2026-0542 breaks sandbox limits. Remote access needs no login. Impact spans full platform control.
| Metric | Details |
|---|---|
| CVE ID | CVE-2026-0542 |
| Type | Remote Code Execution (RCE) |
| Component | AI Platform sandbox (web/API/automation) |
| Attack Vector | Network remote, unauthenticated |
| CVSS Score | 9.8 (Critical) |
| Impact | Code exec, data theft, system takeover |
ServiceNow’s advisory confirms: “Update immediately to protect instances.”
Patch Status by Release
Patches rolled out fast across versions. January Patching Program users got them first.
| Release | Patch/Hotfix | Release Date |
|---|---|---|
| Zurich | Patch 4 Hotfix 3b | Feb 23, 2026 |
| Zurich | Patch 5 | Jan 12, 2026 |
| Yokohama | Patch 10 Hotfix 1b | Feb 18, 2026 |
| Yokohama | Patch 12 | Feb 6, 2026 |
| Xanadu | Patch 11 Hotfix 1a | Feb 2, 2026 |
| Australia | Pending Fix | Expected Q2 2026 |
Hosted customers received auto-updates. Verify your version matches or exceeds these.
Exploit Risks and Impact
Attackers gain full sandbox escape. They could steal AI training data or alter workflows. No user action needed makes it dangerous. Finance, healthcare, and IT firms use ServiceNow most.
Regular patching programs help. Still gaps exist in older releases. Australia users await Q2 fix.
Mitigation Steps
Secure your setup now:
- Check instance against patch table.
- Apply hotfixes via admin console.
- Enable auto-update for hosted plans.
- Scan logs for suspicious API calls.
- Limit AI Platform network access.
Test updates in staging first. Monitor vendor alerts weekly.
FAQ
Unauthenticated RCE in ServiceNow AI Platform sandbox.
None reported at patch release.
Zurich, Yokohama, Xanadu, and earlier.
Remote HTTPS access executes code in sandbox.
ServiceNow KB2693566 security advisory.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages