{"id":"CVE-2024-4879","published":"2024-07-10T17:15:12Z","modified":"2026-06-17T08:03:05Z","title":"ServiceNow Improper Input Validation Vulnerability","vendor":"ServiceNow","product":"Utah, Vancouver, and Washington DC Now Platform","tier":"core","eol":null,"description":{"text":"ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.","provenance":"source","from":"NVD"},"summary":{"text":"ServiceNow's Now Platform, in the Vancouver and Washington DC releases, contains an input validation flaw (classified as improper validation of specified type of input). An unauthenticated remote attacker, requiring no user interaction, could execute code within the context of the Now Platform.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:08:58Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99976,"percentile":0.99979,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-07-29","dueDate":"2024-08-19","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154; https://nvd.nist.gov/vuln/detail/CVE-2024-4879","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-07-23","exploitedFirstSeen":"2024-07-23","ransomware":false,"evidence":[{"url":"https://www.imperva.com/blog/imperva-customers-protected-against-critical-servicenow-vulnerability/","date":"2024-07-23"},{"url":"https://www.resecurity.com/blog/article/cve-2024-4879-and-cve-2024-5217-servicenow-rce-exploitation-in-a-global-reconnaissance-campaign","date":"2024-07-24"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-07-29"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/servicenow-rce","date":"2024-08-06"},{"url":"https://info.greynoise.io/hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf","date":"2025-02-27"},{"url":"https://www.greynoise.io/blog/in-the-wild-activity-targeting-critical-servicenow-vulnerabilities","date":"2025-03-18"},{"url":"https://www.verizon.com/business/resources/T32e/reports/2025-dbir-data-breach-investigations-report.pdf","date":"2025-04-25"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-1287","name":"Improper Validation of Specified Type of Input"}],"references":[{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293","tags":["Permissions Required"]},{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154","tags":["Vendor Advisory"]},{"url":"https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1644293","tags":["Permissions Required"]},{"url":"https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154","tags":["Vendor Advisory"]},{"url":"https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4879","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2024-4879 is a Template Injection Vulnerability in ServiceNow UI Macros. When ServiceNow instances are installed public-facing instead of internally, they can be exploited for arbitrary code execution. Adversaries have been observed selling data exfiltrated through this exploit.","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"primary_impact","evidence":[],"comment":"CVE-2024-4879 is a Template Injection Vulnerability in ServiceNow UI Macros. When ServiceNow instances are installed public-facing instead of internally, they can be exploited for arbitrary code execution. Adversaries have been observed selling data exfiltrated through this exploit.","confidence":"high"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Input Validation","mappingType":"primary_impact","evidence":[],"comment":"CVE-2024-4879 is a Template Injection Vulnerability in ServiceNow UI Macros. When ServiceNow instances are installed public-facing instead of internally, they can be exploited for arbitrary code execution. Adversaries have been observed selling data exfiltrated through this exploit.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-44451","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44451","exploited":true,"exploitedSince":"2024-07-29","provenance":"source"},"exploits":[{"id":52410,"url":"https://www.exploit-db.com/exploits/52410","title":"ServiceNow Multiple Versions - Input Validation & Template Injection","type":"webapps","platform":"multiple","date":"2025-08-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-08-11"},"pocGithub":{"count":7,"skipped":1,"earliest":"2024-07-12","earliestUrl":"https://github.com/Brut-Security/CVE-2024-4879","repos":[{"name":"Brut-Security/CVE-2024-4879","url":"https://github.com/Brut-Security/CVE-2024-4879","stars":25,"created":"2024-07-12"},{"name":"bigb0x/CVE-2024-4879","url":"https://github.com/bigb0x/CVE-2024-4879","stars":10,"created":"2024-07-12"},{"name":"Mr-r00t11/CVE-2024-4879","url":"https://github.com/Mr-r00t11/CVE-2024-4879","stars":4,"created":"2024-07-12"},{"name":"NoTsPepino/CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning","url":"https://github.com/NoTsPepino/CVE-2024-4879-CVE-2024-5217-ServiceNow-RCE-Scanning","stars":4,"created":"2024-07-28"},{"name":"gh-ost00/CVE-2024-4879","url":"https://github.com/gh-ost00/CVE-2024-4879","stars":4,"created":"2024-08-27"}]},"nuclei":[{"id":"CVE-2024-4879","name":"ServiceNow UI Macros - Template Injection","severity":"critical","path":"http/cves/2024/CVE-2024-4879.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4879.yaml"}],"first":{"date":"2024-07-12","source":"PoC-in-GitHub","url":"https://github.com/Brut-Security/CVE-2024-4879"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1059"],"provenance":"source"},{"stage":"primary","techniques":["T1190","T1005"],"provenance":"source"}],"timeline":[{"date":"2024-07-10","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4879","provenance":"source"},{"date":"2024-07-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-08-11","url":"https://github.com/Brut-Security/CVE-2024-4879","provenance":"source"},{"date":"2024-07-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.imperva.com/blog/imperva-customers-protected-against-critical-servicenow-vulnerability/","provenance":"source"},{"date":"2024-07-29","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-07-29","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44451","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":19},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 829 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 7 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}