CVE-2024-5217: ServiceNow Now Platform input validation flaw enables unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with CVSS 9.2, active exploitation per CISA KEV, and an EPSS probability above 99%.

What it is

ServiceNow's Washington DC, Vancouver, and earlier Now Platform releases contain an input validation vulnerability (CWE-184 incomplete list of disallowed inputs, CWE-697 incorrect comparison) that allows an unauthenticated remote attacker to execute code in the context of the Now Platform. It is remotely reachable, requires no credentials or user interaction, and affects core platform instances, making it a high-value target for initial access.

Impact

An attacker gains remote code execution within the Now Platform, which can lead to full compromise of the instance and any data or integrations it holds. Because the platform often stores sensitive workflow, ticket, and identity data, the blast radius extends beyond the server itself.

Attack surface

Reached over the network via the Now Platform interface (CVSS 4.0 vector AV:N/PR:N/UI:N), so no authentication and no user interaction are required. The only noted precondition is AT:P (attack requirements present), meaning some specific target configuration or condition must exist for exploitation.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2024-07-29 with a remediation due date of 2024-08-19, and EPSS shows a 30-day probability of 0.99628 (99.9th percentile), indicating active exploitation in the wild. Press coverage also describes active exploitation of the ServiceNow RCE bugs.

What to do

• Apply the ServiceNow patches and hot fixes released in the June 2024 patching cycle for Washington DC, Vancouver, and earlier Now Platform releases.
• If patching cannot be completed immediately, follow ServiceNow's vendor guidance in KB1644293 and KB1648313 and consider restricting or disabling the affected functionality.
• Limit network exposure of Now Platform instances to trusted networks and users where operationally feasible.
• Monitor for and block exploitation attempts at the edge (WAF/IDS) using vendor and CISA guidance.
• Verify patch level of all Now Platform instances, including non-production and internet-facing ones, and track completion against the CISA due date.

Detection

• Review Now Platform and web server logs for anomalous requests or unexpected code execution patterns around the affected input handling.
• Hunt for unusual child processes, script execution, or outbound connections originating from the Now Platform service account.
• Correlate network and application logs for unauthenticated requests that reach code paths tied to the vulnerable input validation.
• Check for indicators published by ServiceNow and CISA related to this CVE and alert on matches.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.