TL;DR
- what: ServiceNow published an advisory on August 27, 2026 for four AI Platform vulnerabilities, three of which carry a CVSS 10.0 rating and can be reached without authentication.
- impact: An attacker with only network access to a vulnerable instance could execute arbitrary code, write instance data to escalate privileges, or run arbitrary SQL against the backing database, and the CVSS vector claims high impact on connected systems too.
- fix: Apply the fixed builds ServiceNow lists for Xanadu, Yokohama, Zurich, and Australia, for example Xanadu Patch 11 Hot Fix 7a and Australia Patch 5, and confirm CVE-2026-6875 from the July advisory is also closed.
- who: Self-hosted ServiceNow operators carry the full burden; ServiceNow-hosted customers were updated by the vendor but still need to verify their build.
ServiceNow patched four vulnerabilities in the ServiceNow AI Platform on August 27, 2026. Three of them are rated 10.0 on CVSS, the ceiling of the scale, and all three are described as reachable by an unauthenticated attacker. If you run a self-hosted instance, nothing has been fixed for you yet. ServiceNow updated the instances it hosts and handed the update to partners and self-hosted customers, which means the patch action sits with your team.
The three maximum-severity flaws share one vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Read left to right, that is network reachable, low complexity, no attack requirements, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability in both the vulnerable component and the systems downstream of it. There is no user to phish and no credential to steal. Reachability is the whole precondition.
The four CVEs
- CVE-2026-18885 (CVSS 10.0): code injection in the GraphQL Composite Data API. An unauthenticated user could execute arbitrary code and read or modify instance data.
- CVE-2026-18886 (CVSS 10.0): improper access control in the system configuration image upload processor. An unauthenticated user could create or modify instance data, leading to privilege escalation.
- CVE-2026-74820 (CVSS 10.0): SQL injection reached through a dynamic schema ORDER BY clause, allowing arbitrary SQL against the instance database.
- CVE-2026-6876 (CVSS 8.7): a sandbox escape in the Now Platform described as allowing an unauthenticated user to execute arbitrary code.
The three top-rated bugs are distinct classes of failure in three separate components: a data API, an upload handler, and a query builder. That pattern matters when you scope your response. A single hardening measure at the edge will not cover all three, and the presence of three unrelated pre-auth defects in one advisory suggests the review that produced them was broad rather than a single-component sweep.
The ORDER BY injection is worth pausing on. Parameterized queries do not protect an ORDER BY clause, because the clause takes an identifier, not a value. Dynamic schema features that let a user pick a sort column are a classic place for that gap to appear, and the fix normally has to be an allowlist of valid column names. If you have built custom code that sorts on user-supplied field names, treat that as a pattern to audit in your own scoped applications as well.
What the severity ratings actually rest on
The 10.0 scores are ServiceNow's own. ServiceNow is the CVE Numbering Authority for its products, so it assigns the CVE and scores it. Since April 15, 2026, NIST has enriched only vulnerabilities that appear in CISA's Known Exploited Vulnerabilities catalog, affect federal government software, or are designated critical under Executive Order 14028. None of these four were in the KEV catalog as of August 28, 2026. There is no second scoring opinion on record.
That cuts both ways. Nobody has independently confirmed the 10.0s, and nobody has independently disputed them either. The vendor has more visibility into its own code than any outside scorer would, and it chose to publish three maximums and to set attack complexity to low on all three. It scored the earlier July sandbox escape at 9.5 with an identical vector except for high attack complexity, so the difference in scoring is deliberate rather than uniform. Treat the ratings as vendor-supplied and act on them anyway.
⚠️ One internal inconsistency to note — ServiceNow describes CVE-2026-6876 as exploitable by an unauthenticated user, but the CVSS vector it assigned to that same flaw specifies PR:L, low privileges required. That vector also records no impact beyond the vulnerable component. If the prose is right, 8.7 understates it. If the vector is right, some access is needed first. Patch it either way and do not use the 8.7 to defer it past a maintenance window.
Affected versions
- Xanadu: any version before Patch 11 Hot Fix 7a.
- Yokohama: any version before Patch 12 Hot Fix 3b, and any version before Patch 13 Hot Fix 4.
- Zurich: any version before Patch 7b Hot Fix 3, Patch 8 Hot Fix 5, Patch 9 Hot Fix 6, Patch 10 Hot Fix 2m (m-branch), Patch 10 Hot Fix 3 (standard), Patch 11, or Patch 12.
- Australia: any version before Patch 2 Hot Fix 3, Patch 3 Hot Fix 2, Patch 3m, Patch 4, or Patch 5.
Two details will trip up automated scoping. First, all four records set a default product status of unaffected, so any release not named in the list falls outside the affected set rather than defaulting to vulnerable. Second, the record for CVE-2026-18886 marks "Any version before Australia Patch 5" with a status of unknown, while the other three mark that same version as affected. If you are on that build, the safe reading is to patch and stop asking.
The July precedent
This advisory follows CVE-2026-6875, a pre-authentication sandbox escape in the same platform. Searchlight Cyber reported it to ServiceNow on April 1, 2026, and ServiceNow published on July 13. Within days, Defused reported in-the-wild exploitation, then issued a correction stating the captured payload matched Searchlight Cyber's published proof of concept. ServiceNow told The Hacker News its investigation found no evidence the activity was related to instances it hosts.
The useful lesson there is about timing, not attribution. Once a proof of concept for a ServiceNow pre-auth flaw goes public, scanning traffic replaying it shows up in sensors fast enough to be mistaken for real compromise. For the three new flaws, The Hacker News found no public exploit code as of August 28, 2026, and Searchlight Cyber had published no technical write-up. Your patch window is the gap between now and the first write-up, and on the July flaw that gap was measured in days.
Priority order for the next 72 hours — Inventory every ServiceNow instance including non-production and acquired-company tenants, then confirm the build string against the four release families above. Patch self-hosted instances first, since ServiceNow-hosted ones were already updated. Verify the July fix for CVE-2026-6875 is present in the same pass. Then pull web logs for GraphQL Composite Data API calls and configuration image uploads from unauthenticated sessions and check for anything before the patch date.
What to watch
ServiceNow stated in all four records that it is not currently aware of exploitation. That is a statement about vendor visibility on a specific date, not a forecast. Three pre-auth vulnerabilities in an enterprise workflow platform that holds asset inventories, ticket contents, credentials in integration records, and CMDB data is exactly the target profile that draws access brokers. Adam Kues at Searchlight Cyber noted in July that ServiceNow was "severely restricting the type of code that can run in sandbox contexts," so the platform is being hardened while researchers keep finding ways in. Assume a technical write-up lands, and be patched before it does.
Originally published on RedEye Threat Intelligence.
