ServiceNow is informing customers that it has patched a vulnerability that appears to have been exploited by attackers.