Remote Code Execution in ServiceNow AI Platform Sandbox (CVE-2026-0542)

Your instance is affected if it runs Zurich, Yokohama or Xanadu below the patch level ServiceNow lists for this advisory. CVE-2026-0542 lets an unauthenticated attacker execute code inside the ServiceNow AI Platform's sandbox, rated CVSS 9.2 Critical, and ServiceNow patched hosted instances itself. Self-hosted and on-premises deployments stay exposed until someone applies the patch, so your build tag is the only answer worth trusting.

What This Is

In February 2026, ServiceNow disclosed CVE-2026-0542 — a critical remote code execution vulnerability in the ServiceNow AI Platform's sandbox execution environment. An unauthenticated attacker can, under specific conditions, execute arbitrary code within the ServiceNow Sandbox. The root cause is improper isolation or compartmentalization (CWE-653) in the sandbox mechanism that contains and executes AI-related code for features like Now Assist and AI agents.

Note: Attack Complexity is rated High — specific non-trivial conditions must be present for exploitation. This is not a point-and-shoot vulnerability, but the unauthenticated attack vector and critical impact justify immediate patching.

Affected versions: Xanadu, Yokohama, and Zurich releases prior to the patches listed below. The Australia release is not affected.

Fixed Versions

Hosted instances were proactively patched by ServiceNow between January 6 and February 23, 2026 — before public disclosure. Self-hosted and partner instances require manual patch application and are the primary risk surface.

Technical Background

The ServiceNow AI Platform uses a sandbox execution environment to safely contain AI-related code — processing inputs for Now Assist, AI Search, AI agents, and related features. CVE-2026-0542 exploits a flaw in how this sandbox enforces isolation boundaries. Under specific conditions, crafted network requests can cause the sandbox to execute attacker-supplied code beyond the intended containment. Because the AI Platform processes requests from unauthenticated contexts (e.g., Virtual Agent interactions, AI Search queries), no credentials are required to reach the vulnerable code path.

The vulnerability is classified under CWE-653 (Improper Isolation or Compartmentalization), meaning the sandbox's security boundaries do not adequately separate untrusted input processing from privileged execution contexts. This is architecturally similar to container escape vulnerabilities — the containment mechanism itself is the point of failure.

Why This Is Dangerous

Attack Scenario: Unauthenticated Sandbox Escape to Data Exfiltration

Precondition: Target organization runs an unpatched ServiceNow instance (Xanadu, Yokohama, or Zurich) with AI Platform features enabled (Now Assist, AI Search, or AI agents).

Attack chain:

1. Reconnaissance: Attacker identifies the target's ServiceNow instance URL. Instance URLs follow predictable patterns (<company>.service-now.com for hosted instances, custom domains for self-hosted). Login pages, Service Portal pages, and email headers routinely leak instance URLs.

2. Surface Discovery: Attacker probes for AI Platform endpoints that process unauthenticated requests — Virtual Agent chat interfaces, AI Search endpoints, or Now Assist-powered Service Portal widgets. These are publicly accessible by design.

3. Exploitation: Attacker crafts specific requests targeting the AI Platform's sandbox execution path. The crafted input exploits the isolation weakness in the sandbox mechanism. Attack complexity is High — the attacker must identify the precise conditions and input structure required, but no authentication is needed.

4. Sandbox Code Execution: The attacker achieves code execution within the sandbox environment. At this stage, the attacker can:

   • Read and manipulate data accessible to the sandbox runtime
   • Access AI model configurations, prompt templates, and business logic embedded in AI workflows
   • Enumerate integration credentials and API keys used by AI features
   • Access workflow data, automation scripts, and service catalog logic

5. Potential Escalation: Depending on the sandbox's runtime permissions and the instance's security configuration, the attacker may attempt to:

   • Access data beyond the sandbox's intended scope via shared database connections
   • Leverage integration credentials discovered in step 4 to pivot to connected systems
   • Exfiltrate sensitive records — HR cases, incident data, CMDB entries, credentials stored in system properties (→ Secrets and Credentials Stored in ServiceNow Records)

Why the AI Platform is a Recurring Attack Surface

CVE-2026-0542 is the third significant vulnerability in the ServiceNow AI Platform in less than a year:

The pattern is clear: AI Platform components are newer, rapidly evolving code that has not undergone the same years of security hardening as the core platform. Every organization that has enabled Now Assist, AI Search, AI agents, or other AI Platform features has expanded their attack surface with components that are demonstrably less mature from a security standpoint.

Why "Sandbox-Confined" Does Not Mean Low Risk

The CVSS v4.0 vector rates subsequent system impact as None (SC:N/SI:N/SA:N), meaning the vulnerability is formally scoped to the sandbox. This may lead to underestimation of real-world impact:

• The sandbox processes production data — customer queries, HR cases, incident details, service catalog requests
• AI features have integration credentials for connected systems (IntegrationHub, MID Servers, third-party APIs)
• Sandbox isolation failures frequently escalate — the same CWE-653 class produces container escapes in other platforms
• No authentication means the attack is automatable at scale — every unpatched internet-facing instance is a target

How to Detect

Check Current Patch Level

/*
 * CVE-005 Patch Verification Script
 * Checks if instance is running a patched version for CVE-2026-0542
 *
 * Run as: Background script with admin role
 * Impact: Read-only, safe for production
 */

var version = gs.getProperty('glide.war');
var buildDate = gs.getProperty('glide.builddate');
var buildTag = gs.getProperty('glide.buildtag');

gs.info('=== CVE-005: AI PLATFORM SANDBOX RCE PATCH VERIFICATION ===');
gs.info('Instance version: ' + version);
gs.info('Build date: ' + buildDate);
gs.info('Build tag: ' + buildTag);
gs.info('');

// Determine release family
var relFamily = 'Unknown';
if (buildTag.indexOf('xanadu') > -1) relFamily = 'Xanadu';
else if (buildTag.indexOf('yokohama') > -1) relFamily = 'Yokohama';
else if (buildTag.indexOf('zurich') > -1) relFamily = 'Zurich';
else if (buildTag.indexOf('australia') > -1) relFamily = 'Australia';

gs.info('Detected release family: ' + relFamily);
gs.info('');

if (relFamily == 'Australia') {
    gs.info('STATUS: Australia release is NOT affected by CVE-2026-0542.');
} else if (relFamily == 'Unknown') {
    gs.info('STATUS: Could not determine release family. Manually verify against advisory KB2693566.');
} else {
    // Hosted instances were patched between Jan 6 - Feb 23, 2026
    var patchDate = new GlideDateTime('2026-01-06 00:00:00');
    var instanceBuild = new GlideDateTime(buildDate);

    if (instanceBuild.compareTo(patchDate) >= 0) {
        gs.info('STATUS: Build date is ON or AFTER January 6, 2026.');
        gs.info('Instance is LIKELY patched — verify build tag against advisory KB2693566.');
    } else {
        gs.info('STATUS: Build date is BEFORE January 6, 2026.');
        gs.info('*** WARNING: Instance is LIKELY VULNERABLE to CVE-2026-0542 ***');
        gs.info('Apply patches immediately:');
        gs.info('  Xanadu:   Patch 11 Hot Fix 1a');
        gs.info('  Yokohama: Patch 12 (or Patch 10 Hot Fix 1b)');
        gs.info('  Zurich:   Patch 5 (or Patch 4 Hot Fix 3b)');
    }
}

gs.info('');

// Check if hosted
var instanceName = gs.getProperty('instance_name', '');
if (instanceName.indexOf('.service-now.com') > -1) {
    gs.info('Instance type: HOSTED (ServiceNow managed)');
    gs.info('Hosted instances were proactively patched Jan 6 - Feb 23, 2026.');
    gs.info('Verify via System Diagnostics > Stats.');
} else {
    gs.info('Instance type: NON-HOSTED (self-managed)');
    gs.info('CRITICAL: Apply patches manually per ServiceNow advisory KB2693566.');
}

gs.info('');
gs.info('MANUAL VERIFICATION:');
gs.info('1. Navigate to: System Diagnostics > Stats');
gs.info('2. Compare build tag against ServiceNow advisory KB2693566');
gs.info('3. Check AI Platform plugin versions (see next script)');
gs.info('4. Confirm sys_properties: glide.buildtag and glide.war');

Check AI Platform Plugin Status

/*
 * Check if AI Platform plugins are installed and their versions
 * AI Platform components are the affected surface area for CVE-2026-0542
 *
 * Run as: Background script with admin role
 * Impact: Read-only, safe for production
 */

gs.info('=== CVE-005: AI PLATFORM PLUGIN AUDIT ===');

var plugins = new GlideRecord('v_plugin');
plugins.addQuery('id', 'CONTAINS', 'sn_ai');
plugins.orQuery('id', 'CONTAINS', 'now_assist');
plugins.orQuery('id', 'CONTAINS', 'ai_search');
plugins.orQuery('id', 'CONTAINS', 'sn_virtual_agent');
plugins.query();

if (plugins.getRowCount() === 0) {
    gs.info('No AI Platform plugins detected.');
    gs.info('If AI Platform features are not installed, exposure is significantly reduced.');
    gs.info('However, verify patch level regardless — core platform components may include AI Platform code.');
} else {
    gs.info('Installed AI Platform plugins:');
    while (plugins.next()) {
        gs.info('  Plugin: ' + plugins.getValue('id') +
            ' | Name: ' + plugins.getValue('name') +
            ' | Version: ' + plugins.getValue('version') +
            ' | Active: ' + plugins.getValue('active'));
    }
    gs.info('');
    gs.info('AI Platform plugins are installed. This instance has the affected components.');
    gs.info('Patching is REQUIRED regardless of whether these features are actively used.');
}

Check for Indicators of Compromise

/*
 * Post-exploitation indicator check for CVE-2026-0542
 * Look for signs of sandbox abuse during the exposure window
 *
 * Run as: Background script with admin role
 * Impact: Read-only, safe for production
 */

gs.info('=== CVE-005: INDICATOR OF COMPROMISE CHECK ===');
gs.info('Checking for anomalies during the exposure window...');
gs.info('');

// Define exposure window: CVE reserved Dec 30 2025, patches started Jan 6 2026
var windowStart = '2025-12-01';
var windowEnd = '2026-02-25';

// Check for new admin accounts created during exposure window
var users = new GlideRecord('sys_user_has_role');
users.addQuery('role.name', 'admin');
users.addQuery('sys_created_on', '>=', windowStart);
users.addQuery('sys_created_on', '<=', windowEnd);
users.query();

gs.info('Admin role assignments during exposure window (' + windowStart + ' to ' + windowEnd + '):');
if (users.getRowCount() === 0) {
    gs.info('  None found (good)');
} else {
    while (users.next()) {
        gs.info('  User: ' + users.user.user_name + ' | Role: ' + users.role.name +
            ' | Assigned: ' + users.getValue('sys_created_on') +
            ' | Assigned by: ' + users.getValue('sys_created_by'));
    }
    gs.info('  *** Review these assignments for legitimacy ***');
}
gs.info('');

// Check for new scripted REST APIs (persistence mechanism)
var restApis = new GlideRecord('sys_ws_definition');
restApis.addQuery('sys_created_on', '>=', windowStart);
restApis.addQuery('sys_created_on', '<=', windowEnd);
restApis.query();

gs.info('Scripted REST APIs created during exposure window:');
if (restApis.getRowCount() === 0) {
    gs.info('  None found (good)');
} else {
    while (restApis.next()) {
        gs.info('  API: ' + restApis.getValue('name') +
            ' | Created: ' + restApis.getValue('sys_created_on') +
            ' | Created by: ' + restApis.getValue('sys_created_by'));
    }
    gs.info('  *** Review these APIs — unauthorized REST endpoints are a common persistence mechanism ***');
}
gs.info('');

// Check for modified business rules with suspicious patterns
var rules = new GlideRecord('sys_script');
rules.addQuery('sys_updated_on', '>=', windowStart);
rules.addQuery('sys_updated_on', '<=', windowEnd);
rules.addQuery('active', true);
rules.addQuery('script', 'CONTAINS', 'GlideHTTPRequest');
rules.orQuery('script', 'CONTAINS', 'Packages.java');
rules.query();

gs.info('Business rules with external call patterns modified during exposure window:');
if (rules.getRowCount() === 0) {
    gs.info('  None found (good)');
} else {
    while (rules.next()) {
        gs.info('  Rule: ' + rules.getValue('name') +
            ' | Table: ' + rules.getValue('collection') +
            ' | Updated: ' + rules.getValue('sys_updated_on') +
            ' | Updated by: ' + rules.getValue('sys_updated_by'));
    }
    gs.info('  *** Review these rules for unauthorized external data exfiltration ***');
}

Remediation

Step 1: Verify Patch Status (Immediate — Within 72 Hours)

1. Hosted instances: Confirm the proactive patch was applied via System Diagnostics > Stats. Hosted instances were patched between January 6 and February 23, 2026. Verify the build tag matches or exceeds the fixed versions listed above.
2. Self-hosted instances: Download and apply the appropriate patch for your release family immediately:
   • Xanadu: Patch 11 Hot Fix 1a
   • Yokohama: Patch 12 (or Patch 10 Hot Fix 1b)
   • Zurich: Patch 5 (or Patch 4 Hot Fix 3b)
3. Australia release: Not affected by CVE-2026-0542.

Step 2: Assess AI Platform Exposure

If patching requires a maintenance window:

1. Inventory AI Platform features — Run the plugin audit script above to identify which AI Platform components are active
2. Disable unnecessary AI features — If Now Assist, AI Search, or AI agents are not actively used, disable them as an interim measure until patches are applied
3. Restrict AI Platform endpoint access — Use IP ACLs or web application firewall rules to limit access to AI Platform endpoints from trusted networks only
4. Enable enhanced logging — Increase audit logging for AI Platform–related transactions to detect exploitation attempts

Step 3: Investigate Potential Exploitation

If your instance was unpatched during the exposure window (December 2025 – February 2026):

1. Run the IOC detection script above to check for anomalous admin role assignments, new scripted REST APIs, and suspicious business rule modifications
2. Review System Logs > Transactions for unusual requests to AI Platform endpoints — high volume, unusual source IPs, or large response payloads
3. Check sys_user_session for sessions where user agent or IP address changed mid-session (potential credential theft)
4. Audit integration credentials accessible from the AI Platform — if compromised, rotate immediately
5. If indicators of compromise are found, escalate to incident response (→ Incident Response Playbook for Critical CVE Exploitation, → ServiceNow Forensic Evidence Collection & Chain of Custody)

Step 4: Long-Term AI Platform Hardening

1. Review AI Platform feature activation — Only enable AI features that are actively used and have undergone security review (→ Now Assist Prompt Injection Attack Patterns & Defenses)
2. Monitor ServiceNow Trust Portal — Subscribe to security advisories for AI Platform components (→ ServiceNow Trust Portal — Vendor Security Posture and Certification Evidence)
3. Update threat model — Document the AI Platform as a high-risk component requiring dedicated security assessment on each release upgrade (→ OWASP Agentic AI Top 10 Applied to ServiceNow)
4. Enable CSP headers — Content Security Policy provides defense-in-depth against client-side exploitation chains that may accompany sandbox vulnerabilities (→ High Security Plugin (HSP) and Security Hardening Settings)

Regulatory Impact

NIS2 Mapping

DORA Mapping

ISO 27001:2022 Mapping

GDPR Mapping

Expert Notes

This is the third unauthenticated vulnerability in the ServiceNow AI Platform in under a year. The pattern is systemic — AI Platform components are being shipped faster than they are being hardened. Organizations should treat AI Platform feature activation as a risk decision requiring explicit security sign-off, not a default-on capability. The High attack complexity rating provides some comfort that mass exploitation is unlikely, but targeted attacks by sophisticated actors remain a realistic threat. Self-hosted customers who have not yet applied patches should treat this as their highest-priority remediation item.

ServiceNow's proactive patching of hosted instances before public disclosure (Jan 6 vs. Feb 25) is a positive signal — but the 7-week window between patch deployment and disclosure means self-hosted customers operated without awareness of the risk during that period. This disclosure timeline should be discussed with ServiceNow as part of third-party risk management.