CVE-2024-4879 (with CVE-2024-5217): ServiceNow Now Platform unauthenticated RCE, actively exploited
The short version: The ServiceNow Now Platform has input-validation flaws (CVE-2024-4879 and CVE-2024-5217) that let an unauthenticated attacker slip Jelly template expressions past the platform's checks and execute code on the instance. Disclosed together in July 2024, the pair was quickly exploited at scale, and both sit in CISA's KEV catalog. If your instance predates the June 2024 patches, this is patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) — CVE-2024-4879 | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-1287) |
| CVSS v3.1 (NVD) — CVE-2024-5217 | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-184 / CWE-697) |
| EPSS | 99.98% · ~100th percentile (2026-07-17, CVE-2024-4879) |
| In CISA KEV? | Yes — both — remediation due 2024-08-19 |
| Known exploited? | Yes — mass exploitation shortly after the July 2024 disclosure |
| Vulnerability type | Improper input validation in the Jelly template engine → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Now Platform Utah, Vancouver, and Washington DC releases before the June 2024 patches |
| Fixed in | Per ServiceNow KB1644293 — e.g. Utah Patch 10 Hot Fix 3, Vancouver Patch 6 Hot Fix 2 (and Patch 10), Washington DC Patch 1 Hot Fix 3b (and Patch 4), and later |
What you need to know
The Now Platform renders pages with Jelly, a server-side template engine. These flaws are gaps in the input validation meant to keep user-controlled data from being interpreted as template code. An unauthenticated attacker who crafts the right request (for example, against login.do with a malicious jvar parameter) gets their Jelly expression evaluated server-side — the tell-tale being an injected value echoed back — which escalates to command execution on the instance.
- It's pre-authentication and automatable. No credentials, no user interaction; the requests are simple to script and were sprayed widely.
- It was a chain in the wild. Researchers demonstrated combining the input-validation flaws (this pair, alongside a related file-read issue) into full unauthenticated RCE, and attackers followed within days.
- The data behind it is sensitive. ServiceNow instances hold IT, HR, and workflow data, and often integrate deep into the enterprise.
How serious we see it
High — the 9.8 is earned.
Unauthenticated, network-reachable code execution on a SaaS-style platform that holds sensitive enterprise data, mass-exploited and KEV-listed, is top-of-queue. The bounded, reassuring part is that the fixes are published and the affected release/patch levels are specific, so exposure is quick to confirm. The catch is the usual one for a mass-exploited flaw: if you were exposed before patching, patched and clean are separate questions — go look.
Recommendations
Straight from ServiceNow's advisory and CISA:
- Patch now. Apply the June 2024 fixes per ServiceNow KB1644293 for your release family (Utah / Vancouver / Washington DC).
- Hunt for exploitation. Review logs for anomalous requests to
login.doand Jelly/jvarparameters, and for signs of command execution or data access around the exposure window. - If you find indicators, respond. Rotate credentials, API tokens, and integration secrets; investigate connected systems for follow-on access.
- Reduce exposure. Limit internet reachability of non-essential interfaces and enforce strong authentication on the platform.
- Confirm your exposure first. Verify which Now Platform release and patch level your instance runs.
How BreachRisk sees it
BreachRisk discovers internet-facing ServiceNow instances from little more than your domain, fingerprints the platform, and flags exposure tied to these KEV-listed, actively exploited flaws — surfaced at the top of your results because they're in KEV. Where testing is authorized, BreachRisk can safely confirm whether the Jelly injection actually evaluates — a bounded check that returns a benign injected marker — turning "this is ServiceNow" into a verified, prioritized finding.
That outside-in view is exactly what you want when a platform flaw is being sprayed across the internet: the exposed instance is already mapped, so you go straight to patch-and-verify.