ServiceNow has patched four security vulnerabilities affecting its AI Platform and Now Platform. Three of them received the maximum CVSS v4.0 score of 10.0.
The three most serious flaws are especially concerning because, in certain circumstances, they can be exploited remotely by an unauthenticated attacker without any user interaction.
ServiceNow disclosed the vulnerabilities on August 27, 2026.
The Three Critical Vulnerabilities
CVE-2026-18885 — Code Injection
CVSS v4.0: 10.0
This flaw affects the GraphQL Composite Data API in the ServiceNow AI Platform.
Under certain conditions, an unauthenticated attacker could execute arbitrary code within the ServiceNow platform. Successful exploitation could expose or alter instance data beyond the intended security boundaries.
The combination of unauthenticated access and arbitrary code execution makes this a particularly urgent issue for exposed environments.
CVE-2026-18886 — Improper Access Control
CVSS v4.0: 10.0
This vulnerability affects the system configuration image upload processor.
An unauthenticated attacker could, under certain circumstances, create or modify instance data without the required authorization. ServiceNow says successful exploitation could also lead to privilege escalation.
That makes the flaw especially serious in environments where ServiceNow stores sensitive enterprise data or controls important business workflows.
CVE-2026-74820 — SQL Injection
CVSS v4.0: 10.0
This vulnerability involves a dynamic schema ORDER BY clause in the ServiceNow AI Platform.
An unauthenticated attacker could potentially execute arbitrary SQL statements against the underlying database. That creates a direct risk to the confidentiality and integrity of data stored in the affected ServiceNow instance.
This should not be viewed as a database-only problem. The database supports the ServiceNow application and its workflows, so unauthorized database activity could have consequences across the wider platform.
A Fourth Vulnerability Is Also Being Fixed
ServiceNow’s August 27 advisory also covers another vulnerability:
CVE-2026-6876 — CVSS v4.0 8.7
This sandbox escape affects the Now Platform. Under certain circumstances, an unauthenticated user could use it to execute arbitrary code within the platform.
It is important to keep this issue separate from the three CVSS 10.0 vulnerabilities because it has a different severity rating and attack profile.
Why the CVSS 10.0 Rating Matters
The three CVSS 10.0 vulnerabilities share an unusually aggressive attack profile:
- Network reachable
- Low attack complexity
- No privileges required
- No user interaction required
- High confidentiality impact
- High integrity impact
- High availability impact
- High impact to connected systems
The published CVSS v4.0 vector is:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
In practical terms, an attacker does not need a legitimate ServiceNow account or a victim to click a link for the core attack conditions described in the vendor’s scoring.
What ServiceNow Customers Should Do
ServiceNow says it has already deployed security updates to its hosted instances and provided updates to partners and self-hosted customers.
For organizations running self-hosted ServiceNow environments, administrators must verify the deployed release and apply the appropriate security update.
The affected release information includes branches such as Xanadu, Yokohama, Zurich and Australia, with specific patch and hot-fix levels listed in ServiceNow’s August advisory.
Recommended security response
- Identify every ServiceNow instance operated by the organization.
- Determine the exact release and patch level of each instance.
- Compare those versions with ServiceNow’s August 27 security advisory.
- Apply the appropriate security update or upgrade where required.
- Review application, API and authentication logs for unusual activity.
- Look for unexpected API requests, data changes, privilege modifications and suspicious database-related activity.
- Review integrations connected to the affected ServiceNow environment if suspicious activity is found.
ServiceNow says it is not aware of exploitation against its instances involving these four vulnerabilities. As of August 28, The Hacker News had also not identified public exploit code for the three CVSS 10.0 flaws.
The Bigger Security Lesson
The headline is “three CVSS 10.0 vulnerabilities.”
The more important issue is what sits behind that number:
Unauthenticated + Network Reachable + Low Complexity + No User Interaction + Code/Data/Database Access
That combination removes many of the barriers attackers typically face.
Organizations that rely heavily on ServiceNow for ITSM, CMDB, automation and enterprise workflows should treat the platform as a high-value security boundary, not just another business application.
The right response is not to wait for evidence of exploitation.
Verify the version. Confirm the patch. Apply the fix. Then investigate for signs of abuse.
