ServiceNow AI Platform Multiple Vulnerabilities (August 2026 CVE Advisory)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(371202);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/26");

  script_cve_id(
    "CVE-2026-6876",
    "CVE-2026-18885",
    "CVE-2026-18886",
    "CVE-2026-74820"
  );

  script_name(english:"ServiceNow AI Platform Multiple Vulnerabilities (August 2026 CVE Advisory)");

  script_set_attribute(attribute:"synopsis", value:
"ServiceNow AI Platform is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the ServiceNow AI Platform (Now Platform) running on the remote host is missing the
remediations described in the August 2026 CVE Advisory Notification. It is, therefore, affected by
multiple vulnerabilities, including the following:

  - A sandbox escape vulnerability that could allow an unauthenticated user to execute arbitrary code
    within the Now Platform, potentially leading to more access to the Now Platform than intended.
    (CVE-2026-6876)

  - A code injection vulnerability that could enable an unauthenticated user, in certain circumstances,
    to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data
    beyond what was intended. (CVE-2026-18885)

  - A SQL injection vulnerability that could enable an unauthenticated user, in certain circumstances, to
    execute arbitrary SQL statements against the instance's underlying database and gain access to, or
    modify, instance data beyond what was intended. (CVE-2026-74820)

  - An improper access control vulnerability that could enable an unauthenticated user, in certain
    circumstances, to create or modify instance data beyond what was intended, resulting in privilege
    escalation. (CVE-2026-18886)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?be3d21ad");
  script_set_attribute(attribute:"solution", value:
"Upgrade ServiceNow AI Platform to Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b, Yokohama Patch 13
Hot Fix 4, Zurich Patch 7b Hot Fix 3, Zurich Patch 8 Hot Fix 5, Zurich Patch 9 Hot Fix 6, Zurich Patch 10 Hot
Fix 2m (m-branch) or Hot Fix 3 (standard), Zurich Patch 11, Zurich Patch 12, Australia Patch 2 Hot Fix 3,
Australia Patch 3 Hot Fix 2, Australia Patch 3m, Australia Patch 4, or Australia Patch 5, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-6876");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-74820");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/27");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/27");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/23");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:servicenow:servicenow");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("servicenow_platform_web_detect.nbin");
  script_require_keys("installed_sw/ServiceNow Platform");
  script_require_ports("Services/www", 443);

  exit(0);
}

include('webapp_func.inc');
include('vcf.inc');

##
# Determines whether the detected release / patch / hot fix combination is missing the
# August 2026 CVE Advisory remediations. Only the builds the advisory documents as
# remediated are treated as fixed. Each rule is selected by the numeric patch level,
# so a letter respin inherits that level's hot fix threshold unless the advisory
# documents it separately (Zurich Patch 7b, the Patch 10 m-branch, Australia Patch 3m).
# An install reporting no hot fix predates every hot fix of its patch level.
#
# @param release      Lowercased release family name (e.g. 'zurich')
# @param patch_num    Parsed numeric patch level (e.g. '7' for Patch 7b)
# @param patch_letter Patch letter suffix, or NULL for plain patches
# @param hotfix       Parsed hot fix level, or NULL when the detection reports none
#
# @return the fix string when vulnerable, NULL otherwise
##
function is_vuln(release, patch_num, patch_letter, hotfix)
{
  if ('xanadu' >< release)
  {
    # Remediated: Patch 11 Hot Fix 7a
    if (vcf::compare_version_to_check(version:patch_num, comparator:'<', cmp_ver:'11'))
      return 'Xanadu Patch 11 Hot Fix 7a';
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'11') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'7a')))
      return 'Xanadu Patch 11 Hot Fix 7a';
  }
  else if ('yokohama' >< release)
  {
    # Remediated: Patch 12 Hot Fix 3b, Patch 13 Hot Fix 4
    if (vcf::compare_version_to_check(version:patch_num, comparator:'<', cmp_ver:'12'))
      return 'Yokohama Patch 12 Hot Fix 3b';
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'12') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'3b')))
      return 'Yokohama Patch 12 Hot Fix 3b';
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'13') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'4')))
      return 'Yokohama Patch 13 Hot Fix 4';
  }
  else if ('zurich' >< release)
  {
    # Remediated: Patch 7b Hot Fix 3, Patch 8 Hot Fix 5, Patch 9 Hot Fix 6, Patch 10
    # Hot Fix 2m (m-branch) / Hot Fix 3 (standard), Patch 11, Patch 12
    if (vcf::compare_version_to_check(version:patch_num, comparator:'<', cmp_ver:'7'))
      return 'Zurich Patch 7b Hot Fix 3';
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'7'))
    {
      # The Patch 7b respin is remediated from Hot Fix 3 on. Neither plain Patch 7
      # nor any other Patch 7 respin carries a documented fix, so it stays vulnerable.
      if (patch_letter == 'b' && !isnull(hotfix) &&
          vcf::compare_version_to_check(version:hotfix, comparator:'>=', cmp_ver:'3'))
        return NULL;
      return 'Zurich Patch 7b Hot Fix 3';
    }
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'8') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'5')))
      return 'Zurich Patch 8 Hot Fix 5';
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'9') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'6')))
      return 'Zurich Patch 9 Hot Fix 6';
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'10'))
    {
      # The Patch 10 m-branch Hot Fix 2m and the standard Hot Fix 3 are both remediated;
      # any later hot fix counts as remediated, so 2m is the floor.
      if (!isnull(hotfix) &&
          vcf::compare_version_to_check(version:hotfix, comparator:'>=', cmp_ver:'2m'))
        return NULL;
      return 'Zurich Patch 10 Hot Fix 2m (m-branch) or Hot Fix 3 (standard)';
    }
    # Patch 11 and later are remediated.
  }
  else if ('australia' >< release)
  {
    # Remediated: Patch 2 Hot Fix 3, Patch 3 Hot Fix 2, Patch 3m, Patch 4, Patch 5
    if (vcf::compare_version_to_check(version:patch_num, comparator:'<', cmp_ver:'2'))
      return 'Australia Patch 2 Hot Fix 3';
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'2') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'3')))
      return 'Australia Patch 2 Hot Fix 3';
    # The Patch 3m m-branch is itself remediated; any other Patch 3 build needs Hot Fix 2.
    if (vcf::compare_version_to_check(version:patch_num, comparator:'=', cmp_ver:'3') &&
        (isnull(patch_letter) || patch_letter != 'm') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'2')))
      return 'Australia Patch 3 Hot Fix 2';
  }

  return NULL;
}

var app = 'ServiceNow Platform';

# Exit if app is not detected on host
get_install_count(app_name:app, exit_if_zero:TRUE);

# Exit if app is not detected on this http port
var port = get_http_port(default:443);
var install = get_single_install(
  app_name : app,
  port     : port
);

var release = install['Release'];
if (empty_or_null(release)) audit(AUDIT_UNKNOWN_APP_VER, app);

# The InstanceInfo SOAP path registers the release name in lowercase ('zurich');
# the stats.do path registers 'Zurich'. Lower it so a credentialed scan is judged
# by the same rules as an uncredentialed one.
release = tolower(release);

# The detection's Patch regex captures digits only, and for letter-suffixed patch
# levels (Zurich Patch 7b, Australia Patch 3m) it matches nothing at all on the SOAP
# and stats.do paths. Derive the patch level from the raw build stamp instead,
# falling back to the Patch field the detection's mapping path registers.
var build_stamp = install['Build Stamp'];
if (empty_or_null(build_stamp)) build_stamp = install['Build tag'];

var patch_str = NULL;
if (!empty_or_null(build_stamp))
{
  var patch_match = pregmatch(string:build_stamp, pattern:'__patch([0-9]+[a-z]*)-', icase:TRUE);
  if (!isnull(patch_match)) patch_str = patch_match[1];
}
if (empty_or_null(patch_str)) patch_str = install['Patch'];
if (empty_or_null(patch_str)) audit(AUDIT_UNKNOWN_APP_VER, app);

var patch_parts = pregmatch(string:patch_str, pattern:'^([0-9]+)([a-z]*)$', icase:TRUE);
if (isnull(patch_parts)) audit(AUDIT_UNKNOWN_APP_VER, app);

var patch_num = vcf::parse_version(patch_parts[1]);
if (vcf::is_error(patch_num)) audit(AUDIT_UNKNOWN_APP_VER, app);

var patch_letter = NULL;
if (patch_parts[2] != '') patch_letter = patch_parts[2];

var hotfix_str = install['Hotfix'];

# The detection's hot fix regex needs two or more characters, so a single-character
# level such as 'Hot Fix 3' is never stored in Hotfix. Read it from the build stamp instead.
if (empty_or_null(hotfix_str) && !empty_or_null(build_stamp))
{
  var hf_match = pregmatch(string:build_stamp, pattern:'-hotfix([0-9][0-9a-z]*)-', icase:TRUE);
  if (!isnull(hf_match)) hotfix_str = hf_match[1];
}

var hotfix = NULL;
if (!empty_or_null(hotfix_str))
{
  hotfix = vcf::parse_version(string(hotfix_str));
  if (vcf::is_error(hotfix)) hotfix = NULL;
}

var fix_version = is_vuln(release:release, patch_num:patch_num, patch_letter:patch_letter, hotfix:hotfix);
if (!empty_or_null(fix_version))
  vcf::report_results(app_info:install, fix:fix_version, severity:SECURITY_HOLE, flags:{"sqli":TRUE});
else
  audit(AUDIT_INST_VER_NOT_VULN, app);