CVE-2025-11449 & CVE-2025-11450 - Reflected Cross Site Scripting in ServiceNow AI Platform - Security

CVE-2025-11449 & CVE-2025-11450 - Reflected Cross Site Scripting in ServiceNow AI Platform  ServiceNow Posture October, 2025 ServiceNow has addressed unauthenticated reflected cross-site scripting vulnerabilities that were identified in the ServiceNow AI Platform. These vulnerabilities, which are being tracked as CVE-2025-114549 and CVE-2025-11450, could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.

Resolution The security updates listed in the table below address these issues. We have deployed a relevant security update to the majority of hosted customers, and we have made an update available to self-hosted customers, partners, and customers with unique configurations.

ServiceNow strongly recommends applying the appropriate security patch or upgrading as soon as possible.

Release Version Updated Washington DC Washington DC Patch 10 Hot Fix 7b Xanadu Xanadu Patch 10 Hot Fix 1a Xanadu Patch 11

Yokohama

Yokohama Patch 7 Hot Fix 2a

Yokohama Patch 8

Yokohama Patch 9

Zurich Zurich Patch 1 Hot Fix 1a

Zurich Patch 2

Zurich Patch 3

Australia Australia General Availability (GA)

Customers, please review the following KB Articles for further guidance:

[Requires NOW Login] ServiceNow-hosted customers: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2552796 [Requires NOW Login] Self-hosted customers: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2552837 Additional Resources CVE-2025-11449: https://www.cve.org/CVERecord?id=CVE-2025-11449 CVE-2025-11450: https://www.cve.org/CVERecord?id=CVE-2025-11450 Change Log Version Published Summary of Changes 1.0 October 9, 2025 Initial publication