PT-2026-132785
CVE-2026-103093
·
Published
2026-10-29
·
Updated
2026-10-30
Description by
CVSS 4.0
9.4
CriticalMetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
ServiceNow AI Platform (affected versions not specified)
Description
A sandbox escape issue exists in the ServiceNow AI Platform. An authenticated user with the admin role can bypass Rhino sandbox restrictions to execute arbitrary code on the underlying host operating system, which may lead to further unintended access. Rhino is a JavaScript engine that allows the execution of JavaScript code within a controlled environment.
Recommendations
Apply the appropriate updates or upgrade to a patched release.
As a temporary mitigation, restrict the number of users assigned the admin role to minimize the risk of exploitation.
Found an issue in the description? Have something to add? Feel free to write us 👾