Domain Separation Bypass in ServiceNow SR - CSM - Task Plan Templates Store Application
CVE-2026-6877

5.3MEDIUM

Key Information:

Vendor

Servicenow

Status
Servicenow Ai Platform
Vendor
CVE Published:
29 October 2026

What is CVE-2026-6877?

ServiceNow has detected a domain separation bypass issue in the SR – CSM – Task Plan Templates Store application. This vulnerability allows an authenticated user with specific roles to create records within domains they should not have access to. This unauthorized capability could lead to significant security risks and data integrity issues as data can be created across different domain boundaries. Users are encouraged to apply necessary updates or upgrade to a patched version to mitigate this security flaw.

Affected Version(s)

ServiceNow AI Platform 0

References

https://support.servicenow.com/kb?id=kb_article_view&sysp...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanos (mr_srk1337)
.