CVE-2025-11450 Overview
ServiceNow has patched a reflected cross-site scripting (XSS) vulnerability in the ServiceNow AI Platform. The flaw, tracked as CVE-2025-11450, allows attackers to execute arbitrary JavaScript in the browser of a ServiceNow user who clicks a specially crafted link. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
ServiceNow deployed the fix to the majority of hosted instances. Self-hosted customers, partners, and hosted customers with unique configurations received security updates through listed patches and hot fixes. Exploitation requires user interaction, and the vulnerability affects integrity of the vulnerable system component without directly impacting confidentiality or availability.
Critical Impact
An attacker can execute arbitrary script in a victim's authenticated ServiceNow session, enabling session abuse, UI manipulation, and data exfiltration through crafted URLs.
Affected Products
- ServiceNow AI Platform (hosted instances)
- ServiceNow AI Platform (self-hosted deployments)
- ServiceNow hosted customer instances with unique configurations
Discovery Timeline
- 2025-10-10 - CVE-2025-11450 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11450
Vulnerability Analysis
CVE-2025-11450 is a reflected cross-site scripting flaw in the ServiceNow AI Platform. Reflected XSS occurs when a web application echoes attacker-controlled input into an HTTP response without proper output encoding or input sanitization. The malicious payload travels through a URL parameter and executes in the victim's browser under the origin of the trusted ServiceNow instance.
Because the payload runs within the authenticated context of the ServiceNow application, attackers can read Document Object Model (DOM) content, invoke API calls on behalf of the user, and manipulate rendered UI elements. Successful exploitation requires the target to click a crafted link, typically delivered through phishing, chat, or embedded content.
The scope-changed integrity impact indicates that injected script can alter data or behavior in a system component beyond the initially vulnerable endpoint. Confidentiality and availability impacts to the vulnerable system are not directly rated, but session-level abuse remains a realistic downstream risk.
Root Cause
The root cause is improper neutralization of user-supplied input reflected into an HTTP response body. Input that should be treated as data is rendered as executable script by the browser. ServiceNow addressed this by applying server-side sanitization and output encoding in the affected AI Platform components.
Attack Vector
Exploitation is remote over the network, requires no authentication, and requires user interaction. An attacker crafts a URL containing the XSS payload, then lures an authenticated ServiceNow user to click it. When the browser loads the response, the injected script executes inside the ServiceNow origin.
No verified public proof-of-concept is available at the time of writing. See the ServiceNow Knowledge Base Article for vendor-supplied technical details.
Detection Methods for CVE-2025-11450
Indicators of Compromise
- HTTP requests to ServiceNow instance URLs containing script tags, javascript: URIs, or encoded payloads such as %3Cscript%3E in query parameters
- Referrer headers originating from external domains preceding suspicious ServiceNow session activity
- Unexpected outbound requests from ServiceNow user sessions to attacker-controlled domains
Detection Strategies
- Inspect web proxy and web application firewall (WAF) logs for URL parameters containing HTML tags, event handlers such as onerror= or onload=, and obfuscated JavaScript
- Correlate email and messaging gateway telemetry with clicks on links pointing to ServiceNow hostnames that carry unusual query strings
- Review ServiceNow platform audit logs for anomalous user actions occurring immediately after external link clicks
Monitoring Recommendations
- Enable and forward ServiceNow instance access logs to a centralized SIEM for query-string inspection
- Monitor for spikes in 200-response requests to unusual endpoints that reflect input into page bodies
- Alert on browser Content Security Policy (CSP) violation reports originating from ServiceNow origins
How to Mitigate CVE-2025-11450
Immediate Actions Required
- Apply the ServiceNow-supplied patches and hot fixes referenced in the vendor Knowledge Base article to all self-hosted and uniquely configured hosted instances
- Confirm that ServiceNow-managed hosted instances have received the automatic security update
- Educate ServiceNow users to avoid clicking unsolicited links that reference their ServiceNow instance hostname
Patch Information
ServiceNow deployed a security update to the majority of hosted instances and provided patches and hot fixes for self-hosted customers, partners, and hosted customers with unique configurations. Refer to the ServiceNow Knowledge Base Article KB2552817 for the complete list of fixed releases and applicable hot fixes.
Workarounds
- Enforce a strict Content Security Policy on ServiceNow instances to restrict inline script execution and untrusted script sources
- Deploy a web application firewall rule set that blocks HTML and JavaScript syntax in query parameters bound for ServiceNow endpoints
- Restrict ServiceNow instance access to trusted networks or authenticated VPN paths where operationally feasible
# Example WAF rule concept to block reflected XSS payloads targeting ServiceNow
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@rx (?i)(<script|javascript:|onerror=|onload=)" \
"id:1011450,phase:2,deny,status:403,msg:'Potential XSS payload targeting ServiceNow (CVE-2025-11450)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
