[Security Advisory] CVE-2026-0542 - Remote Code Execution in ServiceNow AI Platform - Security

[Security Advisory] CVE-2026-0542 - Remote Code Execution in ServiceNow AI Platform  ServiceNow Posture February, 2026 Description ServiceNow has addressed a critical vulnerability, tracked as CVE-2026-0542, that was identified in the ServiceNow AI Platform. This vulnerability could potentially enable an unauthenticated user, in certain circumstances, to remotely execute code within the ServiceNow Sandbox.

At this time, ServiceNow is unaware of this issue being exploited in the wild against customer instances.

Resolution The security updates listed in the table below address the vulnerability. Additionally, on January 6, 2026, ServiceNow addressed this vulnerability by deploying a security update to affected hosted customer instances. Security updates have also been provided to ServiceNow self-hosted customers and partners. If a notification was not received, your instance was not impacted.

Additionally, we recommend customers promptly apply the below updates or newer if they have not already done so.

Customers who participated in the January Patching Program received the appropriate update.

Release Fixed Version When Available Australia Australia Q2 2026 Zurich Patch 4 Hotfix 3b February 23, 2026 Patch 5 January 12, 2026 Yokohama Patch 10 Hotfix 1b February 18, 2026 Patch 12 February 6, 2026 Xanadu Patch 11 Hotfix 1a February 2, 2026 Additional Resources Customers, please review the following KB Articles for further guidance:

CVE - https://www.cve.org/CVERecord?id=CVE-2026-0542 [Requires NOW Login] ServiceNow-hosted customers: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2699920 [Requires NOW Login] Self-hosted customers: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2699945 Change Log Version Published Summary of Changes 1.0 February 25, 2026 Initial publication