CVE-2026-6877

MediumCVSS 5.3/10Last modified Oct 30, 2026

Description

ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries.

We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Metrics

CVSS 4.0 5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
ServiceNow	ServiceNow AI Platform	< SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)

References

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994

Timeline

Published: Oct 29, 2026
Last modified: Oct 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-687709.8sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiti CVE-2026-687719.8ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attacker CVE-2026-687728.0ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access CVE-2026-687758.8Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.CVE-2026-687766.5Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687776.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687786.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687796.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-68785.6A vulnerability was identified in ByteDance verl up to 0.7.0. Affected is the function math_equal of the file prime_math/grader.py. The mani CVE-2026-687806.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687816.5Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.CVE-2026-687829.9Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to