CVE-2025-11449

Reflected Cross Site Scripting in ServiceNow AI Platform

MEDIUM

5.3

CVSS Score

Published: October 10, 2025 at 01:15 AM UTC

Updated: October 8, 2026 at 01:10 PM UTC

1 product affected across 1 vendorAI Platform

Using ServiceNow AI Platform by ServiceNow?

Get instant alerts when new vulnerabilities affect ServiceNow AI Platform - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.3

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link. ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configuration. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

AI Platform · Servicenow

90%

0 ≤ v < Australia General Availability (GA)0 ≤ v < Washington DC Patch 10 Hot Fix 7b0 ≤ v < Xanadu Patch 10 Hot Fix 1a0 ≤ v < Xanadu Patch 110 ≤ v < Yokohama Patch 7 Hot Fix 2a0 ≤ v < Yokohama Patch 80 ≤ v < Yokohama Patch 90 ≤ v < Zurich Patch 1 Hot Fix 1a0 ≤ v < Zurich Patch 20 ≤ v < Zurich Patch 30

Affected range stops below Australia General Availability (GA), so it looks safe — our inference, not a vendor statement

Affected range stops below Washington DC Patch 10 Hot Fix 7b, so it looks safe — our inference, not a vendor statement

Affected range stops below Xanadu Patch 10 Hot Fix 1a, so it looks safe — our inference, not a vendor statement

Affected range stops below Xanadu Patch 11, so it looks safe — our inference, not a vendor statement

Affected range stops below Yokohama Patch 7 Hot Fix 2a, so it looks safe — our inference, not a vendor statement

Affected range stops below Yokohama Patch 8, so it looks safe — our inference, not a vendor statement

Affected range stops below Yokohama Patch 9, so it looks safe — our inference, not a vendor statement

Affected range stops below Zurich Patch 1 Hot Fix 1a, so it looks safe — our inference, not a vendor statement

Affected range stops below Zurich Patch 2, so it looks safe — our inference, not a vendor statement

Affected range stops below Zurich Patch 3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Source: cverecord

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2552817

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.3MEDIUMSN

Vector?

Quick Info

StatusDEFERRED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card