CVE-2026-6877

Domain Separation Bypass in ServiceNow AI Platform

No known exploitation. No EPSS score yet. Fixed in SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application).

CVSS —Not scored EPSS percentile—No score yet CISA KEVNot listedNo confirmed exploitation
No public exploit known FixSR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)Upgrade to this build

Published 2026-10-29Updated 2026-10-29Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

ServiceNow AI PlatformAffected: < SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)Upgrade to: SR - CSM - Task Plan Templates v3.0 (Task Plan Templates application)Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

What it is

From the CVE record

ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

In plain language

No plain-language summary for this CVE yet.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

CISA KEV: Not in the catalog. CISA has not confirmed exploitation.
Public exploits: No public exploit or proof of concept found in the sources we track.
EPSS: No EPSS score yet. New CVEs are usually scored within a few days.