ServiceNow patches three maximum severity flaws that could put enterprise data at risk

ServiceNow released patches for three maximum-severity vulnerabilities in its AI Platform that could allow attackers to execute arbitrary code, modify data, and escalate privileges without requiring user authentication or interaction. These flaws exploit code injection (inserting malicious code into input fields) and SQL injection (manipulating database queries), which remain effective attack methods decades after their discovery. Cloud-based instances have been automatically updated, but ServiceNow urges self-hosted customers to apply patches immediately.