[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217](/blog/servicenow-vulnerabilities) Publish date January 16, 2025 {x} minute read # ServiceNow Vulnerabilities: CVE-2024-4789 and CVE-2024-5217 [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-third-party-risk-management) [Free trial](/demo) Written by [Nicholas Sollitto](/team/nicholas-sollitto) Senior Cybersecurity Writer Nicholas's cybersecurity writing has been featured in G2. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) In late July 2024, the [US Cybersecurity and Infrastructure Security Agency (CISA)](https://www.cisa.gov/) added two critical vulnerabilities (CVE-2024-4789 and CVE-2024-5217) affecting ServiceNow to its list of known exploited vulnerabilities. These vulnerabilities can allow unauthenticated users to execute code remotely, posing severe risks to organizations that use the platform. The potential for unauthorized access and severe data breaches makes addressing these vulnerabilities crucial. ## Understanding CVE-2024-4789 and CVE-2024-5217 CVE-2024-4789 and CVE-2024-5217 are vulnerabilities in the ServiceNow platform, both with critical Common Vulnerability Scoring System (CVSS) scores of 9.3 and 9.2, respectively. CVE-2024-4789 is due to improper input validation, while CVE-2024-5217 involves an incomplete list of disallowed inputs. Exploiting these vulnerabilities could allow attackers to bypass security mechanisms, execute remote code, and even gain unauthorized administrative privileges, potentially leading to a complete server takeover. ServiceNow identified weakness enumeration [CWE-2187](https://cwe.mitre.org/data/definitions/1287.html) in vulnerability CVE-2024-4789 and [CWE-184](https://cwe.mitre.org/data/definitions/184.html) in vulnerability CVE-2024-5217. The National Institute of Standards and Technology (NIST) also identified weakness enumeration [CWE-697](https://cwe.mitre.org/data/definitions/697.html) in vulnerability CVE-2024-5217 and is still conducting analysis for an additional, unnamed CWE in vulnerability CVE-2024-4789.  ## Why addressing these vulnerabilities matters Failure to address these vulnerabilities could lead to severe consequences, including data breaches, service disruptions, or total loss of control over your IT infrastructure. As attackers can leverage these vulnerabilities to impersonate authenticated users, organizations must act swiftly to mitigate the risks associated with CVE-2024-4789 and CVE-2024-5217. ## What to do next: assess and mitigate risks ### Step 1: See if you’re affected ‍ * **Check your internal systems**: UpGuard Breach Risk automatically detects CVE-2024-4789 and CVE-2024-5217 across your internal IT infrastructure. Navigate to your detected vulnerabilities feed within Breach Risk and search for each CVE to determine if your systems are affected. - **Check your vendors**: Assess your vendor ecosystem's exposure using UpGuard Vendor Risk. Go to the Portfolio Risk Profile and search for CVE-2024-4789 and CVE-2024-5217 to see if any of your vendors are impacted. If a vendor is at risk, you can send a remediation request directly through UpGuard to initiate a response. ### Step 2: If you’re affected, take immediate action * **Ensure ServiceNow is updated**: Make sure you are using the latest version of ServiceNow (the "Washington DC" release from Q2 2024). Check for and apply relevant security patches and hotfixes from the National Vulnerability Database. * **Mitigate risk across your ecosystem**: Evaluate risk exposure not just within your organization but also across third and fourth-party vendors. If any vulnerabilities are detected, take prompt steps to mitigate them, such as removing the vulnerable version, applying patches, or changing configurations to minimize risk. If you or one of your vendors uses ServiceNow, you should ensure you’re using the latest version and then prepare to carry out the next steps around risk mitigation and incident response. If you detect a vendor at risk of either of these vulnerabilities, you can send a remediation request directly within UpGuard, allowing the technology owner to understand the tool's current state and the necessary steps to achieve comprehensive remediation.  ## Detecting vulnerabilities with UpGuard UpGuard’s vulnerabilities module helps you mitigate security threats proactively by automatically detecting risks across your internal infrastructure from exposed information in your HTTP headers, website content, open ports, and other common attack vectors. With our third-party monitoring feature, you’ll also be able to identify potential risks and known vulnerabilities across your vendor network. UpGuard provides a comprehensive approach to vulnerability scanning and continuous security monitoring by automatically detecting risks across your internal infrastructure and across your vendor ecosystem: * **Attack surface monitoring**: UpGuard Breach Risk helps you detect critical vulnerabilities like CVE-2024-4789 and CVE-2024-5217 across your internal attack surface, ensuring swift identification and remediation. * **Continuous security monitoring**: With UpGuard Vendor Risk, you can monitor your vendors’ exposure to these vulnerabilities and take corrective action. This proactive approach helps you ensure that both you and your vendors maintain a secure and resilient infrastructure. eBook A Complete Guide to Third-Party Risk Management Free resource ### A Complete Guide to Third-Party Risk Management Learn how to protect your business with an effective cybersecurity program. [Download now](/resources/complete-guide-to-third-party-risk-management) ## Related posts Learn more about the latest issues in cybersecurity. Risks and Vulnerabilities #### [25 Security Vulnerabilities That Have Defined the 2020s (Thus Far)](/blog/top-25-security-vulnerabilities-of-the-2020s) From Log4j to SolarWinds, discover the 25 critical security vulnerabilities that have reshaped cybersecurity thus far in the 2020s. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) May 28, 2026 Risks and Vulnerabilities #### [PHP2Shell: A Clear Explanation and Response Framework](/blog/php2shell-a-clear-explanation-and-response-framework) PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets unauthenticated attackers run code on PHP servers. Learn who’s affected and how to respond. [](/team/upguard) [UpGuard Team](#) October 22, 2026 Risks and Vulnerabilities #### [Everything Everywhere: Systemic Data Exposure in Supabase Apps](/blog/everything-everywhere-systemic-data-exposure-in-supabase-apps) Supabase is a favorite of AI coding agents. It's also prone to misconfiguration. We studied more than 16,000 open databases to see what's leaking. [](/team/greg-pollock) [Greg Pollock](#) October 14, 2026 Risks and Vulnerabilities #### [Oracle Just Shipped 1,449 Security Patches in One Quarter. We Checked How Much of It Is Actually New.](/blog/oracle-just-shipped-1-449-security-patches-in-one-quarter-we-checked-how-much-of-it-is-actually-new) Oracle's July 2026 update shipped 1,449 security patches — 2.8x its all-time record. We parsed 23 quarters of advisories to find out how much is truly new. [](/team/greg-pollock) [Greg Pollock](#) July 22, 2026 Risks and Vulnerabilities #### [Data leakage risks with DBHub MCP servers](/blog/data-leakage-risks-with-dbhub-mcp-servers) UpGuard found exposed DBHub servers leaking live databases to the open internet—an early sign that MCP exposure is becoming a systemic data risk. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Risks and Vulnerabilities #### [Understanding and Mitigating CVE-2025-55182 (React2Shell)](/blog/understanding-and-mitigating-cve-2025-55182-react2shell) CVE-2025-55182 is a critical unauthenticated RCE in React Server Components (CVSS 10.0). Check if your Next.js or React 19 app is vulnerable and patch now. [](/team/edward-kost) [Edward Kost](#) December 14, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)