What happened
ServiceNow remediated CVE-2026-103093, a 9.4/10 CVSS vulnerability in ServiceNow AI Platform that let authenticated admin-role users bypass Rhino sandbox restrictions and execute arbitrary code on the host OS.
Why it matters
An admin-level flaw that reaches the host OS could open unintended access beyond the platform itself, so self-hosted customers still behind on updates carry the exposure; ServiceNow says it is not aware of malicious exploitation.
WHO IT HITSIT and security teams running self-hosted ServiceNow AI Platform instances, especially those with admin-role users, need to apply the update promptly; hosted-instance operators are already covered by ServiceNow's deployment.
Summaries like this, every morning.
ServiceNow has already pushed the fix to its hosted instances and handed the update to partners and self-hosted customers, which puts the remaining risk on organizations that run the platform themselves and have not yet applied it. The vulnerability is gated behind the admin role, so the population that could trigger it is narrower than the platform's full user base, but the impact described is broad: bypassing the Rhino sandbox and executing code on the underlying host operating system could lead to further unintended access.
The advisory ties the flaw to CWE-284, an improper access control weakness. ServiceNow states that it is not currently aware of malicious exploitation against its instances, so the practical urgency is about closing the window before any is observed rather than responding to an active incident.
Pick your industry and the AI tools you use, and get news related to your work every day.
Free · 30 seconds with Google · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. The AI reads this article, earlier AIToday articles, and Wikipedia, and cites its sources. Q&As are published on this page for other readers too.
