A high-severity safety flaw has been disclosed in ServiceNow’s platform that, if efficiently exploited, might end in knowledge publicity and exfiltration.
The vulnerability, tracked as CVE-2025-3648 (CVSS rating: 8.2), has been described as a case of information inference in Now Platform by way of conditional entry management listing (ACL) guidelines. It has been codenamed Depend(er) Strike.
“A vulnerability has been recognized within the Now Platform that might end in knowledge being inferred with out authorization,” ServiceNow stated in a bulletin. “Beneath sure conditional entry management listing (ACL) configurations, this vulnerability might allow unauthenticated and authenticated customers to make use of vary question requests to deduce occasion knowledge that’s not supposed to be accessible to them.”
Cybersecurity firm Varonis, which found and reported the flaw in February 2024, stated it might have been exploited by malicious actors to acquire unauthorized entry to delicate info, together with personally identifiable info (PII) and credentials.
At its core, the shortcoming impacts the report depend UI factor on listing pages, which could possibly be trivially abused to deduce and expose confidential knowledge from numerous tables inside ServiceNow.
“This vulnerability might have doubtlessly affected all ServiceNow situations, impacting lots of of tables,” Varonis researcher Neta Armon stated in a Wednesday evaluation.
“Most regarding, this vulnerability was comparatively easy to use and required solely minimal desk entry, reminiscent of a weak person account throughout the occasion or perhaps a self-registered nameless person, which might bypass the necessity for privilege elevation and resulted in delicate knowledge publicity.”
Particularly, the corporate discovered that entry to ServiceNow tables, whereas ruled by ACL configurations, could possibly be used to glean info, even in situations the place entry is denied as a consequence of a failed “Information Situation” or “Script Situation” — which makes it potential to conditionally present entry primarily based on an analysis of sure data-related standards or customized logic.
In these circumstances, customers are displayed a message, stating “Variety of rows faraway from this listing by Safety constraints” together with the depend. Nonetheless, when entry to a useful resource is blocked as a consequence of “Required Roles” or “Safety Attribute Situation,” customers are displayed a clean web page with the message “Safety constraints forestall entry to the requested web page.”
It is price mentioning that the 4 ACL situations are evaluated in a selected order, beginning with roles, adopted by safety attributes, knowledge situation, and lastly, script situation. For a person to achieve entry to a useful resource, all of those situations should be glad. Any situation that is left empty is taken into account as not having any type of restriction.
The truth that the responses are completely different primarily based on the 4 ACL situations opens a brand new assault pathway {that a} menace actor can exploit to find out which entry situations aren’t glad, after which repeatedly question the database desk to enumerate the specified info utilizing a mix of question parameters and filters. Tables protected solely by a knowledge or script situation are vulnerable to the inference assault.
“Any person in an occasion can exploit this vulnerability, even these with minimal privileges and no assigned roles, so long as they’ve entry to no less than one misconfigured desk,” Armon stated. “This vulnerability applies to any desk within the occasion with no less than one ACL rule the place the primary two situations are both left empty or are overly permissive — a typical scenario.”
To make issues worse, a menace actor might develop the blast radius of the flaw utilizing strategies like dot-walking and self-registration to entry further knowledge from referenced tables, create accounts and achieve entry to an occasion with out requiring prior approval from an administrator.
ServiceNow, in response to the findings, has launched new safety mechanisms, reminiscent of Question ACLs, Safety Information Filters, and Deny-Except ACLs, to counter the danger posed by the information inference blind question assault. Whereas there isn’t any proof that the problem was ever exploited within the wild, all ServiceNow clients are urged to use the required guardrails on delicate tables.
“ServiceNow clients also needs to bear in mind that question vary Question ACLs will quickly be set to default deny, so they need to create exclusions to take care of licensed person means to carry out such actions,” Armon stated.
DLL Hijacking Flaw in Lenovo’s TrackPoint Fast Menu Software program
The event comes as TrustedSec detailed a privilege escalation flaw (CVE-2025-1729) in TrackPoint Fast Menu software program (“TPQMAssistant.exe”) current in Lenovo computer systems that might allow a neighborhood attacker to escalate privileges by way of a DLL hijacking vulnerability.
The flaw has been addressed in model 1.12.54.0 launched on July 8, 2025, following accountable disclosure earlier this January.
“The listing housing ‘TPQMAssistant.exe’ is writable by normal customers, which is already a crimson flag,” safety researcher Oddvar Moe stated. “The folder’s permission permits the CREATOR OWNER to put in writing recordsdata, that means any native person can drop recordsdata into this location.”
“When the scheduled job (or the binary itself) is triggered, it makes an attempt to load ‘hostfxr.dll’ from its working listing however fails, leading to a NAME NOT FOUND occasion. This tells us the binary is searching for a dependency that does not exist in its personal listing – an ideal alternative for sideloading.”
Because of this, an attacker can place a malicious model of ‘hostfxr.dll’ within the listing “C: ProgramDatalLenovolTPQMAssistant” to hijack management stream when the binary is launched, ensuing within the execution of arbitrary code.
Microsoft Addresses Kerberos DoS Bug
The findings additionally observe the general public disclosure of an out-of-bounds learn flaw in Home windows Kerberos’ Netlogon protocol (CVE-2025-47978, CVSS rating: 6.5) that might allow a certified attacker to disclaim service over a community. The vulnerability was addressed by Microsoft as a part of its Patch Tuesday updates for July 2025.
Silverfort, which has assigned the title NOTLogon to CVE-2025-47978, stated it permits any “domain-joined machine with minimal privileges to ship a specially-crafted authentication request that may crash a site controller and trigger a full reboot.”
“This vulnerability doesn’t require elevated privileges — solely normal community entry and a weak machine account are wanted. In typical enterprise environments, any low-privileged person can create such accounts by default,” safety researcher Dor Segal stated.
The cybersecurity firm additionally famous that the crash primarily affected Native Safety Authority Subsystem Service (LSASS), a crucial safety course of in Home windows that is answerable for imposing safety insurance policies and dealing with person authentication. Profitable exploitation of CVE-2025-47978 might due to this fact destabilize or disrupt Energetic Listing companies.
“With solely a sound machine account and a crafted RPC message, an attacker can remotely crash a site controller – a system answerable for the core functionalities of Energetic Listing, together with authentication, authorization, Group Coverage enforcement, and repair ticket issuance,” Segal stated.