CVE Watch—

CVE-2024-4879

ServiceNow Improper Input Validation Vulnerability

CVSS

—

No CVSS

EPSS

100.0%

p100

KEV

YES

Jul 29, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

100.0%EPSS · 30 days100.0%

2026-09-162026-10-14

KEV catalog record

Product

ServiceNow / Utah, Vancouver, and Washington DC Now Platform

Vulnerability

ServiceNow Improper Input Validation Vulnerability

Added to KEV

Jul 29, 2024

Remediate by

Aug 19, 2024

Known ransomware use

Summary description

ServiceNow Utah, Vancouver, and Washington DC Now Platform releases contain a jelly template injection vulnerability in UI macros. An unauthenticated user could exploit this vulnerability to execute code remotely.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154; https://nvd.nist.gov/vuln/detail/CVE-2024-4879

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-5217—

99.9%

KEV—80ServiceNow Incomplete List of Disallowed Inputs Vulnerability—