2026-08-29 · view entry permalink →
CVE-2026-18885 / CVE-2026-18886 / CVE-2026-74820 / CVE-2026-6876, ServiceNow AI Platform: three unauthenticated CVSS 10.0 flaws plus a related Now Platform sandbox escape
ServiceNow's 27 August 2026 advisory (KB3152242) discloses four flaws, found through the vendor's own security
research and responsible-disclosure program rather than external report
(ServiceNow, 2026-08-27). Three,
CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820, are unauthenticated flaws in the ServiceNow AI Platform that
ServiceNow's own text classifies as critical: CVE-2026-18885 as code injection letting an unauthenticated user
execute arbitrary code and gain access to, or modify, instance data; CVE-2026-74820 as SQL injection letting an
unauthenticated user execute arbitrary SQL against the instance's own database; CVE-2026-18886 also as code
injection, but described as letting an unauthenticated user create or modify instance data, resulting in privilege
escalation
(ServiceNow, 2026-08-27). The
Hacker News reports the same three at a numeric CVSS4.0 score of 10.0; ServiceNow's own advisory gives only the
qualitative "critical" label, never a numeric score
(The Hacker News, 2026-08-28). The
Hacker News, reporting on the same advisory, assigns each a more specific mechanism: CVE-2026-18885 as a code
injection in the GraphQL Composite Data API, CVE-2026-74820 as a SQL injection reached through a dynamic-schema
ORDER BY clause, and CVE-2026-18886 as an improper-access-control flaw in the system-configuration image-upload
processor enabling privilege escalation, a classification that differs from ServiceNow's own "code injection"
description of the same id
(The Hacker News, 2026-08-28). All
three share the identical CVSS4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H per The Hacker
News's reporting, network-reachable, low attack complexity, no privileges, no user interaction, high impact to the
vulnerable component and connected systems
(The Hacker News, 2026-08-28). A
fourth, related flaw, CVE-2026-6876, is a sandbox escape ServiceNow's own text describes as letting an
unauthenticated user execute arbitrary code within the Now Platform
(ServiceNow, 2026-08-27). The
Hacker News reports the CVSS4.0 vector ServiceNow assigned to it in fact specifies PR:L (low privileges required)
rather than none (an inconsistency with ServiceNow's own "unauthenticated user" prose) scores it 8.7, and connects
it to CVE-2026-6875, a pre-auth ServiceNow sandbox escape Searchlight Cyber reported to ServiceNow on 1 April 2026,
with the vendor's own advisory for it published on 13 July 2026
(The Hacker News, 2026-08-28).
ServiceNow deployed the update to hosted instances directly and provided it to partner and self-hosted customers, who must apply it themselves; those customers should verify their instance version against the vendor's fixed-build table, spanning the Xanadu, Yokohama, Zurich and Australia release lines, each with its own minimum hotfix (The Hacker News, 2026-08-28). ServiceNow reports no awareness of exploitation for any of the four flaws, and The Hacker News found no public proof-of-concept for the three maximum-severity flaws as of 28 August 2026 (The Hacker News, 2026-08-28). Because ServiceNow is its own CVE Numbering Authority and none of the four flaws meet NIST's current post-April-2026 enrichment criteria (CISA KEV listing, federal-software impact, or an Executive Order 14028 critical designation), ServiceNow's own severity ratings are the only assessment on record for any of them (The Hacker News, 2026-08-28), a vulnerability-management process that ranks purely on NVD-enriched severity will not see the urgency here.
Detection concept: ServiceNow instance and application audit logs, and GraphQL API access logs, for anomalous or malformed API mutations originating from unauthenticated sessions; database-audit telemetry for dynamic-schema queries carrying non-schema tokens; system-configuration change-audit records for writes not tied to an authenticated administrative session. No public exploit code exists yet, so this is patch-priority guidance rather than an active-exploitation hunt.
ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended.
ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database
A code injection vulnerability in the GraphQL Composite Data API that could enable an unauthenticated user to execute arbitrary code and gain access to, or modify, instance data
An improper access control vulnerability in the system configuration image upload processor that could enable an unauthenticated user to create or modify instance data, resulting in privilege escalation
None of the four flaws appeared in the catalog as of August 28, 2026, leaving ServiceNow's ratings as the only severity assessment on record.
The company said it deployed a security update to hosted instances and provided the update to its partners and self-hosted customers, which leaves organizations that run their own instances to apply the fixes themselves.
Builds on: 2026-07-13/servicenow-ai-platform-sandbox-escape-cve-2026-6875