CVE-2024-5217

CVE-2024-5217 is an input validation flaw — an incomplete list of disallowed inputs (CWE-184/CWE-697) — in ServiceNow's Now Platform, affecting the Washington DC, Vancouver, and earlier releases, with CISA's advisory listing the Utah, Vancouver, and Washington DC releases. Because the flaw is reachable over the network without credentials or user interaction (CVSS 4.0: 9.2 critical, AV:N/AC:L/PR:N/UI:N), an unauthenticated remote attacker can send crafted input to the platform to trigger it. Successful exploitation yields remote code execution in the context of the Now Platform, with high impact on the confidentiality, integrity, and availability of the instance. Any organization running an affected release is affected, and since Now Platform instances are typically internet-facing, exposure extends beyond internal networks. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2024-07-29 and public reporting indicates cyber agencies have warned that hackers are actively targeting critical ServiceNow vulnerabilities, while EPSS assigns a 99.6% probability of exploitation within 30 days (100th percentile); no public proof-of-concept is known, but the fixes shipped in ServiceNow's June 2024 patching cycle, so unpatched instances remain at risk.

What to do: Inventory all ServiceNow instances, identify those on Washington DC, Vancouver, or earlier releases (including Utah), and apply the relevant June 2024 patching-cycle patches/hot fixes published by ServiceNow immediately, prioritizing internet-facing instances. The flaw is in CISA's KEV catalog (added 2024-07-29) with a 99.6% EPSS score, so treat unpatched instances as actively targeted and, if patching must be delayed, follow vendor mitigation guidance or restrict network access to the instance.