VulnRadar

Data against noise.

Page generated: 08 Nov 2026, 07:04 UTC

CVE-2024-5217

Read full description

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE

0.0/10

REALITY · THREAT PRIORITY

9.0/10

General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?

Recorded exploitation baseline: +7.00
Technical severity: CVSS 9.8: +1.47
Fresh EPSS: 99.63%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 10 documents and public datasets.

Hype components

Headline sample (25%)

0/100

Press, 30 days (60%)

0/100

Grounded branding (15%)

0/100

HYPE TOTAL0/100

Sources and documents

Rescana

Press · 22 Mar 2025, 07:00 · ServiceNow Vulnerabilities: Critical Exploits Impacting Israel and Global Systems - Rescana

SC Media

Press · 21 Mar 2025, 07:00 · Attacks involving ServiceNow vulnerabilities escalate - SC Media

TechCrunch

Press · 20 Mar 2025, 07:00 · Hackers are ramping up attacks using year-old ServiceNow security bugs to target unpatched systems - TechCrunch

The Record from Recorded Future News

Press · 30 Jul 2024, 07:00 · Critical ServiceNow vulnerabilities being targeted by hackers, cyber agency warns - The Record from Recorded Future News

www.thestack.technology

Press · 30 Jul 2024, 07:00 · CISA warns of three critical exploited vulnerabilities - www.thestack.technology

See all 10 source documents

Dark Reading

Press · 29 Jul 2024, 07:00 · Patch Now: ServiceNow Critical RCE Bugs Under Active Exploit - Dark Reading

SC Media

Press · 26 Jul 2024, 07:00 · Foreign threat actors exploit ServiceNow bugs - SC Media

BleepingComputer

Press · 25 Jul 2024, 07:00 · Critical ServiceNow RCE flaws actively exploited to steal credentials - BleepingComputer

Resecurity

Press · 24 Jul 2024, 07:00 · CVE-2024-4879 and CVE-2024-5217 (ServiceNow RCE) Exploitation in a Global Reconnaissance Campaign - Resecurity

Arctic Wolf

Press · 17 Jul 2024, 07:00 · Vulnerabilities CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217 - Arctic Wolf

Score evolution

● Hype ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

Public exploit entries / repo candidates

Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence: Exploitation recorded
Priority basis: Recorded exploitation; CVSS 9.8; EPSS 99.6%
Attention, last 30 days: 0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential: network access, no prior privileges, no user interaction.
Observed activity: Exploitation recorded in CISA KEV.
Known scale: Not quantified.
Evidence confidence basis: Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:21.056913+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline

Published

10 Jul 2024, 16:28

First press mention

17 Jul 2024, 07:00

Added to the CISA KEV catalog

29 Jul 2024, 00:00

Latest press mention

22 Mar 2025, 07:00

Score calculated

05 Nov 2026, 13:59