ServiceNow AI Platform: Sandbox escape in Rhino sandbox
Summary
ServiceNow AI Platform contains a sandbox escape in the Rhino sandbox. An authenticated user with the admin role can bypass the sandbox restrictions and execute arbitrary code on the underlying host operating system, which may enable further unintended access. Exploitation requires a valid admin session, not anonymous internet access. ServiceNow has deployed the fix to hosted instances and provided it to partners and self-hosted customers.
Affected
- ServiceNow AI Platform versions before Yokohama Patch 13 Hot Fix 4a
- ServiceNow AI Platform versions before Zurich Patch 10 Hot Fix 3b
- ServiceNow AI Platform versions before Zurich Patch 12
- ServiceNow AI Platform versions before Zurich Patch 13
- ServiceNow AI Platform versions before Australia Patch 5
- Version list taken from the CVE record; verify against KB3228994 before patching.
Fixed in
- Yokohama Patch 13 Hot Fix 4a
- Zurich Patch 10 Hot Fix 3b
- Zurich Patch 12
- Zurich Patch 13
- Australia Patch 5
- Hosted instances: updated by ServiceNow.
Workaround
Unknown.
Exploitation
- ServiceNow is not currently aware of malicious exploitation.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof-of-concept exploit has been verified.
Our recommendation
- Confirm the instance release and patch level against KB3228994.
- Apply the fix to self-hosted or partner-managed instances.
- Limit the admin role to the fewest necessary users and review admin accounts and recent admin logins.
- Treat as high priority for self-hosted instances or instances with many admin users; hosted instances already updated by ServiceNow need routine verification.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- ServiceNow Security Advisory KB3228994 support.servicenow.com
- CVE-2026-103093 record (threatint) cve.threatint.com
- CVE-2026-103093 (Strix) www.strix.ai
- CVE-2026-103093 (VulDB) vuldb.com
- CVE-2026-103093 (OffSeq Radar) radar.offseq.com
- Rhino sandbox escape analysis (palk.sh) palk.sh
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:38.
Original description (NVD)
ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.