CVE-2024-4879

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 99.98%
EPSS Percentile: 99.98%
CISA KEV: YES — Known Exploited Vulnerability

Description

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 11-Jul-2024 00:15
Last Modified: 17-Jun-2026 15:03
EPSS Date: 2026-10-22
CWE: CWE-1287

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2024-07-29
Remediation Due: 2024-08-19
Known Ransomware Campaign Use: Unknown
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1645154; https://nvd.nist.gov/vuln/detail/CVE-2024-4879

Affected Products / Versions

servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:-:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:early_availability:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_1_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_10a_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_2_hotfix_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_3_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_3b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_4b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_4_hotfix_5:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_5:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_5_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_6:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_6_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_7b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_8:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_8_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: utah
cpe:2.3:a:servicenow:servicenow:utah:patch_9_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:-:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_1_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_10:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_2_hotfix1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_3_hotfix_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_1b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_4_hotfix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_5_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_6_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_1a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_2b:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_7_hotfix_3a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_8_hotfix_3:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: vancouver
cpe:2.3:a:servicenow:servicenow:vancouver:patch_9:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:-:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_1_hotfix_2a:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_2_hotfix_1:*:*:*:*:*:*
servicenow / servicenow Source: NVD CPE · affected
Version / affected range: washington_dc
cpe:2.3:a:servicenow:servicenow:washington_dc:patch_3:*:*:*:*:*:*

References

Last enrichment sync: 02-Nov-2026 07:31
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Two years ago, threat actors chained three ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) using publicly available exploits to breach private firms and government agencies worldwide in data theft ServiceNow Patches Three Critical AI Platform Vulnerabilities

CVE (7)

MITRE ATT&CK (1)

Vendors (1)

Products (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.