What’s Vulnerable › Vulnerabilities
CVE-2026-103093: Sandbox Escape via Table Rotation in ServiceNow AI Platform
- Severity: critical (CVSS 9.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-29 · updated 2026-10-30
- Weakness: CWE-284
Description
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Summary
CVE-2026-103093 is a critical (CVSS 9.4) sandbox escape in the ServiceNow AI Platform that lets an authenticated admin-role user bypass Rhino sandbox restrictions and run arbitrary code on the underlying host OS, potentially enabling further unintended access. It affects the ServiceNow AI Platform and is fixed in Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b, Zurich Patch 12, and Zurich Patch 13. ServiceNow has updated hosted instances and distributed the fix to partners and self-hosted customers; no malicious exploitation is currently known. Apply the appropriate update or upgrade to a patched release promptly if you have not already done so.
CVE-2026-103093 هو ثغرة حرجة (CVSS 9.4) من نوع الهروب من بيئة العزل (sandbox escape) في ServiceNow AI Platform، تتيح لمستخدم مصادَق يحمل دور admin تجاوز قيود Rhino sandbox وتنفيذ تعليمات برمجية عشوائية على نظام التشغيل المضيف، مما قد يتيح وصولاً غير مقصود إضافياً. تؤثر الثغرة في ServiceNow AI Platform وتم إصلاحها في Yokohama Patch 13 Hot Fix 4a وZurich Patch 10 Hot Fix 3b وZurich Patch 12 وZurich Patch 13. قامت ServiceNow بتحديث النسخ المستضافة وبتزويد الشركاء والعملاء الذين يستضيفون الخدمة ذاتياً بالتحديث، ولا يُعرف حالياً أي استغلال خبيث. يُنصح العملاء بتطبيق التحديثات المناسبة أو الترقية إلى إصدار مُصلَح فوراً إن لم يفعلوا ذلك بعد.
Affected products
- ServiceNow AI Platform: before Yokohama Patch 13 Hot Fix 4a; before Zurich Patch 10 Hot Fix 3b; before Zurich Patch 12; before Zurich Patch 13; before Australia Patch 5 — fixed in Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b, Zurich Patch 12, Zurich Patch 13, Australia Patch 5
How to fix
Upgrade to a fixed version: ServiceNow AI Platform Yokohama Patch 13 Hot Fix 4a, Zurich Patch 10 Hot Fix 3b, Zurich Patch 12, Zurich Patch 13. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-103093 or the next vulnerability affects your stack