CVE-2026-6877
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
61/100
Published: 2026-10-29
Modified: 2026-10-29
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
X
AT:
None
VC:
None
VI:
Low
VA:
None
Description
ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| ServiceNow | ServiceNow AI Platform | 0 < SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) |
| ServiceNow | ServiceNow AI Platform | 0 < SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) |