CVE-2026-103094

HighCVSS 7.1/10Last modified Oct 30, 2026

Description

ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could cause a user's plaintext password to be persisted in a system table, potentially exposing that password to a user who otherwise would not be entitled to view it.

ServiceNow remediated the vulnerability through security updates that address the unintended persistence of plaintext credentials. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Metrics

CVSS 4.0 7.1/10CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-256

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ServiceNowServiceNow AI Platform< Xanadu Patch 11 Hot Fix 7a; < Yokohama Patch 13 Hot Fix 4a; < Zurich Patch 10 Hot Fix 3a; < Zurich Patch 11 Hot Fix 1; < Zurich Patch 11m (m-branch); < Zurich Patch 12; < Zurich Patch 13; < Australia Patch 2 Hot Fix 3b; < Australia Patch 4 Hot Fix 1; < Australia Patch 4m (m-branch); < Australia Patch 5

References

Timeline

Published
Oct 29, 2026
Last modified
Oct 30, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1030967.5API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitiveCVE-2026-1030977.5An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitCVE-2026-1030987.5Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather than HTTPS, meaning thCVE-2026-1030997.5Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a sCVE-2026-10316.1IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. TCVE-2026-1031007.5Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trigCVE-2026-1031017.5Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to CVE-2026-1031028.6Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to triggeCVE-2026-1031047.5Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a reCVE-2026-1031058.8Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attacCVE-2026-1031067.8Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service thCVE-2026-1031087.5Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a re
CVE-2026-103094: High severity, CVSS 7.1 | Vulnix