Unauthenticated RCE in ServiceNow via GlideRecord Sandbox Escape
Researchers discovered a pre-authentication remote code execution flaw in ServiceNow's GlideRecord API. By injecting JavaScript into query filters, they escaped the JS sandbox and seized full control of the instance and linked proxy servers. The bug enables anyone on the internet to compromise ServiceNow deployments without credentials.