Security News > 2024 > July > Critical ServiceNow RCE flaws actively exploited to steal credentials
Threat actors are chaining together ServiceNow flaws using publicly available exploits to breach government agencies and private firms in data theft attacks.
On July 10, 2024, ServiceNow made hotfixes available for CVE-2024-4879, a critical input validation flaw enabling unauthenticated users to perform remote code execution on multiple versions of the Now Platform.
The next day, on July 11, Assetnote researchers who discovered the flaw published a detailed write-up about CVE-2024-4879 and two more flaws in ServiceNow that can be chained for full database access.
Resecurity has seen elevated chatter about the ServiceNow flaws on underground forums, especially by users seeking access to IT service desks and corporate portals, indicating a high interest from the cybercrime community.
CISA warns critical Geoserver GeoTools RCE flaw is exploited in attacks.
RCE bug in widely used Ghostscript library now exploited in attacks.
News URL
Related news
- Critical PHP RCE vulnerability mass exploited in new attacks (source)
- Critical RCE flaw in Apache Tomcat actively exploited in attacks (source)
- Critical Veeam Backup & Replication RCE vulnerability fixed, patch ASAP! (CVE-2025-23120) (source)
- Infoseccers criticize Veeam over critical RCE vulnerability and a failing blacklist (source)
- Critical Ingress NGINX Controller Vulnerability Allows RCE Without Authentication (source)
- Gladinet’s Triofox and CentreStack Under Active Exploitation via Critical RCE Vulnerability (source)
- Critical Erlang/OTP SSH pre-auth RCE is 'Surprisingly Easy' to exploit, patch now (source)
- Critical Erlang/OTP SSH RCE bug now has public exploits, patch now (source)
- Critical Commvault RCE vulnerability fixed, PoC available (CVE-2025-34028) (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-07-10 | CVE-2024-4879 | Unspecified vulnerability in Servicenow Utah/Vancouver ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. | 9.8 |