servicenow security

The servicenow security tag covers urgent guidance for internet-facing ServiceNow Now Platform instances affected by CVE-2024-4879 and CVE-2024-5217. Its featured content emphasizes applying the relevant fixed release, restricting public access while verification remains incomplete, and treating deployments as exposed until patch levels and ownership are confirmed. The discussion distinguishes ServiceNow-hosted tenants, where the vendor reported deploying updates, from self-hosted and partner-managed environments that require direct verification. It also records the July 2024 disclosure timeline and CISA’s later addition of both vulnerabilities to its Known Exploited Vulnerabilities catalog. This archive is focused on containment, patch validation, and deployment-specific risk assessment.