Cyber Resilience

CVE-2026-0542

Critical

Published: 25 February 2026

Published
25 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 9.2 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0062 45.0th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-0542 is a critical-severity Improper Isolation or Compartmentalization (CWE-653) vulnerability in Servicenow (inferred from references). Its CVSS base score is 9.2 (Critical).

Operationally, ranked at the 45.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Supply Chain and Deployment risk domain.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow Sandbox. ServiceNow addressed this vulnerability by deploying a…

more

security update to hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and hot fixes. While we are not currently aware of exploitation against customer instances, we recommend customers promptly apply appropriate updates or upgrade if they have not already done so.

CWE(s)

AI Security AnalysisAI

AI Category
Enterprise AI Assistants
Risk Domain
Supply Chain and Deployment
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: ai

Related Threats

CVEs Like This One

CVE-2025-1974Shared CWE-653
CVE-2024-0135Shared CWE-653
CVE-2026-40968Shared CWE-653
CVE-2025-12805Shared CWE-653
CVE-2024-0136Shared CWE-653
CVE-2025-21590Shared CWE-653
CVE-2026-4282Shared CWE-653
CVE-2024-47520Shared CWE-653
CVE-2026-34775Shared CWE-653

Affected Assets

Servicenow
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-653

Defines isolation boundaries by specifying which external systems may access or process organization data.

addresses: CWE-653

Maintains isolation and compartmentalization by restricting flows between security domains or levels.

addresses: CWE-653

Reviewing the continued need for connections supports isolation and compartmentalization.

addresses: CWE-653

Locating systems away from hazards improves isolation and compartmentalization from external physical or environmental threats.

addresses: CWE-653

The CONOPS must articulate isolation and compartmentalization expectations for security and privacy, making architectural failures in separation of duties or domains harder to overlook.

addresses: CWE-653

Security architectures commonly incorporate isolation and compartmentalization strategies to limit the impact of compromises.

addresses: CWE-653

Organization-wide privacy program leadership ensures proper isolation and compartmentalization of personal data.

addresses: CWE-653

Oversight ensures data-matching activities maintain required isolation between distinct data sets and authorized user communities.

References