CVE-2025-3089: Broken Access Control in ServiceNow AI Platform
ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3089?
CVE-2025-3089 has been rated as a medium severity vulnerability.
How do I fix CVE-2025-3089?
To remediate CVE-2025-3089, update to the latest version of the ServiceNow AI Platform as provided by the vendor.
Who is affected by CVE-2025-3089?
CVE-2025-3089 affects users of the ServiceNow AI Platform, specifically low privileged users.
What actions can be taken to mitigate CVE-2025-3089?
Mitigating CVE-2025-3089 involves implementing stricter access controls and ensuring user role privileges are properly enforced.
Is CVE-2025-3089 being actively exploited?
As of now, there have been no reports indicating that CVE-2025-3089 is actively being exploited in the wild.