CVE-2024-4879: ServiceNow Now Platform input validation flaw allows unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 4.0 score of 9.3, CISA KEV listing, and near-maximum EPSS probability make this an urgent patch-first issue.

What it is

ServiceNow's Now Platform (Vancouver and Washington DC releases) contains an input validation vulnerability that lets an unauthenticated remote attacker execute code in the platform's context. Because the platform is widely used for IT service management and often internet-facing, successful exploitation gives a foothold inside enterprise environments. ServiceNow has patched hosted instances and released updates for self-hosted customers.

Impact

An unauthenticated attacker can run arbitrary code with the privileges of the Now Platform, potentially leading to full compromise of the instance and access to connected enterprise data and systems.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS 4.0 vector (AV:N/PR:N/UI:N). Any internet-exposed or internally reachable Now Platform instance running an affected release is a candidate target.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-07-29 with a due date of 2024-08-19, and press coverage describes active exploitation; EPSS is 0.99976 (99.978th percentile). No ransomware campaign use is documented in the record.

What to do

• Apply the ServiceNow patches and hot fixes for the Vancouver and Washington DC releases immediately; hosted instances were already updated by ServiceNow.
• If patching cannot be completed at once, follow ServiceNow's vendor guidance and consider restricting or discontinuing external exposure of the instance.
• Limit network access to the Now Platform to trusted sources and remove any unnecessary internet-facing exposure.
• Verify the instance version against ServiceNow's advisory to confirm whether it is affected.
• Monitor for signs of compromise on instances that were exposed before patching.

Detection

• Review Now Platform logs for anomalous or unexpected requests and errors consistent with input validation bypass attempts.
• Hunt for unexpected processes, scripts, or outbound connections originating from the Now Platform host.
• Check for unauthorized changes to platform configuration, users, or records that could indicate post-exploitation activity.
• Correlate network logs for scanning or exploitation attempts against Now Platform endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.