ServiceNow CVE-2024-8923

What it is. Someone who has never logged in can break out of the Now Platform's server-side script sandbox and execute code in the platform's own context. ServiceNow rates it 9.3 out of 10 — critical.

Are you exposed? Xanadu shipped clean at general availability. Washington DC and Vancouver need the patch levels listed below.

All three of those release families are now out of support. An instance still running one of them is not simply unpatched for this CVE — it is receiving no security fixes at all, and later flaws on this same page will never have a fixed version for it.

What to do. Upgrade to a supported release. Applying the listed patch closes this CVE, but on an out-of-support release it closes only this one.

Has it been used? Not visibly. There is no CISA KEV entry and no public exploit in the sources tracked here.

The pattern worth seeing. This is the earliest of three sandbox escapes ServiceNow has published for the same containment boundary: CVE-2024-8923 (October 2024, CVSS 9.3), CVE-2026-6875 (July 2026, CVSS 9.5, ServiceNow AI Platform) and CVE-2026-6876 (August 2026, CVSS 8.7), across twenty-two months. Its answer to the second was not another patch but a replacement of the runtime — Guarded Script, the Server-Side Sandbox Runtime Replacement (KB2944435). An instance that still permits complex inline server-side script is carrying the risk the sequence is about, whatever its patch level.

For analysts. The vector is AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H with SC:N/SI:N/SA:N — total impact on the instance, but assessed as not reaching beyond it. Worth reading against the class label: the downstream CWE is CWE-94 and NVD titles it remote code execution, while ServiceNow's own CVE Record names it a sandbox escape. Those describe one thing from two ends — the injection is the mechanism, the escape is what makes it matter. Disclosed alongside CVE-2024-8924 (unauthenticated blind SQL injection) in ServiceNow's October 2024 Patching Program.

What this page can tell you. The patch levels below were checked against ServiceNow's own CVE Record, so the free check gives you a straight patched-or-affected answer from your release and patch level. Nobody has written a detection rule for this CVE, so the paid log check will tell you it could not look rather than guess — it never reports an attack it did not actually see.