ServiceNow disclosed three vulnerabilities in advisory KB3228994 on October 29, led by CVE-2026-103093, a critical sandbox escape in the ServiceNow AI Platform. The flaw lets an authenticated administrator bypass the Rhino sandbox and run code on the host operating system.
CVE-2026-103093 Breaks Out of the Rhino Sandbox
CVE-2026-103093 is rated critical. An authenticated admin can bypass the Rhino sandbox, the scripting environment that confines code on the platform, and execute code on the host OS. The requirement of an authenticated administrator limits who can trigger the flaw, though the result is possible host takeover.
The vulnerability affects the ServiceNow AI Platform in the Yokohama, Zurich and Australia releases.
Two Further Flaws in the Same Advisory
The same advisory covers two other issues. CVE-2026-103094, rated high, persists a user’s plaintext password in a system table. CVE-2026-6877, rated medium, is a domain separation bypass in the SR/CSM Task Plan Templates Store app. Domain separation is the mechanism that keeps tenants’ data apart, so a bypass raises the possibility of data leakage in multi-tenant setups.
How ServiceNow Found the Flaws and What It Reports
ServiceNow found the issues through internal testing and bug bounty reports. The reporting notes no exploitation and no public proof of concept.
ServiceNow serves about 85% of the Fortune 500, according to the source. That customer base explains why a platform-level flaw draws attention even when exploitation requires administrator credentials.
Multi-Tenant Risk From the Domain Separation Bypass
The combination of host takeover and data leakage in multi-tenant setups defines the impact described in the reporting. CVE-2026-103093 targets the host, while CVE-2026-6877 targets the boundary between tenants within the Task Plan Templates Store app, which is affected in version 2.0.0 and earlier.
ServiceNow Hotfix Levels for Yokohama, Zurich and Australia
ServiceNow issued hotfixes for each affected release train:
- Yokohama Patch 13 Hotfix 4a or 5a
- Zurich Patch 10 Hotfix 3b or 4b
- Australia Patch 5
For the Task Plan Templates app, the fix is version 3.0.0 or later, or version 2.0.1.
Plaintext Password Persistence in CVE-2026-103094
CVE-2026-103094 stands out because it involves a user’s plaintext password being stored in a system table. The reporting does not say how that table can be read or by whom, so the exposure depends on the access an attacker already has. Rated high rather than critical, it is the middle entry in the advisory’s severity range.
All three issues were found by ServiceNow or by researchers reporting through its bug bounty program, rather than by attackers. That origin matches the report that no exploitation has been observed. The advisory and hotfixes appeared together on October 29, so the fixes were available at the moment of disclosure. For customers, the disclosure’s detail is the list of specific hotfix levels per release, which determines whether a given instance already carries the correction for CVE-2026-103093.
Scope of ServiceNow’s October 29 Advisory and Affected Releases
Advisory KB3228994 covers the AI Platform across three named release families, Yokohama, Zurich and Australia, plus the Task Plan Templates Store app in versions 2.0.0 and earlier. Each family has its own hotfix numbering. Yokohama has two patched hotfix levels built on Patch 13, Zurich has two built on Patch 10, and Australia is addressed in Patch 5 with no separate hotfix letter.
The severity spread runs from critical (CVE-2026-103093) to high (CVE-2026-103094) to medium (CVE-2026-6877). Only the first allows code to run on the host. The second concerns a stored plaintext password, and the third concerns tenant separation in one app.
Who Found the Flaws and What Is Known About Exploitation
ServiceNow identified the three issues through internal testing and bug bounty reports, and the reporting lists no exploitation and no public proof of concept. The exposed population is large, since the company serves about 85% of the Fortune 500, but the attack on CVE-2026-103093 still needs an authenticated administrator account.
