CVE-2026-103093

Sandbox Escape via Table Rotation in ServiceNow AI Platform

No known exploitation. No EPSS score yet. Fixed versions are out.

CVSS —Not scored EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix1 product4 fixed builds listed below

Published 2026-10-29Updated 2026-10-29Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

ServiceNow AI PlatformAffected: < Yokohama Patch 13 Hot Fix 4aUpgrade to: Yokohama Patch 13 Hot Fix 4aAffected: < Zurich Patch 10 Hot Fix 3bUpgrade to: Zurich Patch 10 Hot Fix 3bAffected: < Zurich Patch 12Upgrade to: Zurich Patch 12Affected: < Zurich Patch 13Upgrade to: Zurich Patch 13 + 1 more branchStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.