CVE Feed

    Dashboard / CVE / CVE-2026-6877

    CVE-2026-6877

    ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries.  We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

    Published:Oct 29, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 29, 2026
    EPSS Score:
    CVSS Score:5.3

    Affected Products

    Vendor
    Servicenow
    Product
    Servicenow Ai Platform

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-103093 (CVSS 9.4) — ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. T…
    CVE-2026-103094 (CVSS 7.1) — ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Pla…
    CVE-2026-86860 (CVSS 9.3) — ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platf…
    CVE-2026-86859 (CVSS 8.7) — ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Plat…
    CVE-2026-13016 (CVSS 9.3) — ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. Thi…
    CVE-2026-86858 (CVSS 8.7) — ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI P…
    CVE-2026-86857 (CVSS 8.4) — ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Plat…
    CVE-2026-74820 (CVSS 10) — ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. …
    CVE-2026-18886 (CVSS 10) — ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI pl…
    CVE-2026-18885 (CVSS 10) — ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. Th…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High