Resurgence of In-The-Wild Activity Targeting Critical Service Now Vulnerabilities
Summary: GreyNoise reports a resurgence of in-the-wild activity against three ServiceNow vulnerabilities, with attacker interest in all three in the past 24 hours and the highest number of unique IPs targeting them in the past month. Over 70% of sessions in the past week were directed at systems in Israel, with targeted systems also detected in Lithuania, Japan, and Germany, and the vulnerabilities reportedly may be chained together for full database access.
What you should know: The vulnerabilities can reportedly be chained for full database access, and at least one is not in CISA's Known Exploited Vulnerabilities catalog, so patch prioritization driven by the KEV list alone would miss it.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026