ServiceNow Incomplete List of Disallowed Inputs Vulnerability (CVE-2024-5217)

A remote attacker, without authentication, can achieve full data confidentiality loss, arbitrary modification of data, complete denial of service or system unavailability. Federal agencies are required to remediate by 2024-08-19 under CISA BOD 22-01.

This is a Software Vulnerability (CWE-184) (CWE-184) vulnerability in ServiceNow Utah, Vancouver, and Washington DC Now Platform. ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible. Exploitation requires remote network access, low attack complexity, no authentication required, and no user interaction required.

Probably yes if any of these apply:

Active exploitation documented in the wild. Threat-research write-up: https://www.darkreading.com/cloud-security/patchnow-servicenow-critical-rce-bugs-active-exploit