CVE-2025-11450: Reflected Cross Site Scripting in ServiceNow AI Platform
ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could result in arbitrary code being executed within the browsers of ServiceNow users who click on a specially crafted link.
ServiceNow has addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Relevant security updates also have been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Further, the vulnerability is addressed in the listed patches and hot fixes. We recommend customers promptly apply appropriate updates or upgrade if they have not already done so.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11450?
CVE-2025-11450 is considered a high-severity vulnerability due to its potential to execute arbitrary code in user browsers.
How do I fix CVE-2025-11450?
To fix CVE-2025-11450, update your ServiceNow AI Platform to the latest patched version provided by ServiceNow.
Who is affected by CVE-2025-11450?
CVE-2025-11450 affects users of the ServiceNow AI Platform who may click on specially crafted malicious links.
What type of vulnerability is CVE-2025-11450?
CVE-2025-11450 is classified as a reflected cross-site scripting (XSS) vulnerability.
Can CVE-2025-11450 lead to data breaches?
Yes, CVE-2025-11450 could potentially lead to data breaches if arbitrary code is executed in the browsers of affected users.