Enterprise SaaS Attack Surface

ServiceNow's three CVSS 10.0 flaws run with the privileges of the platform itself

The writeup lists three conditions that all have to hold for exploitation, and an instance that answers on the public internet already satisfies the first, leaving only the hotfix and the WAF rules standing between exposure and exploit -- which is why this is a same-day hotfix, not a sprint ticket.