CVE-2026-103093

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

• CWE-284

• https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3228994

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103086Missing Authorization vulnerability in Stiofan UsersWP users…6.5
• CVE-2026-103087Uncontrolled recursion in the Gosub browser engine (gosub-en…7.1
• CVE-2026-103088Handlebars.java before 4.5.5 allows directory traversal. In …7.5
• CVE-2026-103090Missing Authentication for Critical Function (CWE-306) and I…8.8
• CVE-2026-103091Missing Authorization (CWE-862) and Initialization of a Reso…9.3
• CVE-2026-103092IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote a…8.5
• CVE-2026-103094ServiceNow has remediated an information disclosure vulnerab…7.1
• CVE-2026-103096API key is hardcoded and retrievable from the application pa…7.5
• CVE-2026-103097An API key is hardcoded and retrievable from the application…7.5
• CVE-2026-103098Transmission of a sensitive key in the URL over an unencrypt…7.5
• CVE-2026-103099Pexip Infinity before 41.1 is affected by improper input val…7.5
• CVE-2026-1031IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2…6.1