Live › vulnerability › CVE-2026-6877
ServiceNow's SR – CSM – Task Plan Templates Store application has a domain separation bypass. An authenticated user with a specific role can create records in domains they should not have access to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 19:26 UTC. All times on this page are UTC.
Organizations running the ServiceNow SR – CSM – Task Plan Templates Store application in a domain-separated instance. Exposure requires an authenticated user holding a specific role. Sources do not say which role or which versions are affected. Instances without this application or without domain separation are likely not affected.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Store application. This vulnerability could enable an authenticated user with a specific role to create records in domains they do not have access to, potentially leading to unauthorized data creation across domain boundaries.
We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
This page as .md · .json · in your agent: get_signal("CVE-2026-6877")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.