CVE mismatch between MDE and ServiceNow in Vulnerability Response - Support and Troubleshooting

CVE mismatch between MDE and ServiceNow in Vulnerability Response Issue .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } CVE vulnerabilities imported from Microsoft Threat and Vulnerability Management (MS TVM) and created in ServiceNow does not match, particularly in severity.

For example, CVE-2025-2222 with a source_severity value of '1' from Microsoft is mapped to '5 – None' instead of the expected '1 – Critical'.

This results in incorrectly prioritized vulnerabilities.

Symptoms .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Not only MS TVM imported CVE entries are affected by this, if the source of a CVE is any other integration – other than NVD integration – the imported CVEs are mapped incorrectly in case the records has a non-empty CVSS score.

Release .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Not specific to any release.

We are working towards having separate columns for the NVD and TVM, which will ensure that nothing is overridden.

Cause .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } }

1. The severity mapping process in ServiceNow uses CVSS scores (v4_base_score, v3_base_score, or score) as input when available, overriding the source_severity value. This causes mismatches when CVSS scores are present, as the system lacks corresponding severity mappings for these values. 2. The business rule 'Lookup normalized severity' prioritizes CVSS scores over source_severity, leading to incorrect normalized_severity assignments for non-NVD sources like MS TVM.

Resolution .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } - The changes are provided like this because of the Business rule that we have "Lookup normalized severity"

- In this business rule, the normalized_Severity is calculated based on v4 or v3 or v2 and then the source_severity.

- Customers need to ensure whether they want to always use the severity that is coming from Microsoft. If yes, they need to convert this line in the below script to include

Script Include : MicrosoftTVMVulnerabilitiesProcessor

var severity = gs.nil(vulnerability.getValue("u_severity")) ? "5" : this.SEVERITY_MAPPING[vulnerability.getValue("u_severity")]; gr.setValue("source_severity", severity);

TO

v ar severity = this.SEVERITY_MAPPING[vulnerability.getValue("u_severity")]; gr.setValue("source_severity", severity);

and adjust the Lookup normalized severity business rule to always use source_severity to map the normalized_severity like below:

(function executeRule(current, previous /*null when async*/ ) { var severityMapping = new sn_vul.SeverityMapping(); // Which field holds the source severity depends on the class. var sourceSeverity; switch (current.sys_class_name.toString()) { case 'sn_vul_third_party_entry': case 'sn_vul_app_vul_entry': sourceSeverity = current.source_severity; break; default: if (current.source_severity != '') sourceSeverity = current.source_severity; else if (current.v4_base_score != '') sourceSeverity = current.v4_base_score; else if (current.v3_base_score != '') sourceSeverity = current.v3_base_score; else sourceSeverity = current.score; } // Now that we have source data, perform normalization and store. var targetSeverity = severityMapping.mapSeverity(current.source, sourceSeverity); if (targetSeverity > 0) current.source_normalized_severity = targetSeverity; else if(targetSeverity == 0) current.source_normalized_severity = 5; if(!current.is_severity_recasted || gs.nil(current.is_severity_recasted)) { current.normalized_severity = current.source_normalized_severity; } })(current, previous);