CVE-2026-6877
Description
ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
How to fix
- ServiceNow ServiceNow AI PlatformSR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ServiceNow ServiceNow AI Platform | v < SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) | SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.