ServiceNow AI Platform

CVE-2026-18885 / CVE-2026-18886 / CVE-2026-74820 / CVE-2026-6876, ServiceNow AI Platform: three unauthenticated CVSS 10.0 flaws plus a related Now Platform sandbox escape

ServiceNow's 27 August 2026 advisory (KB3152242) discloses four flaws, found through the vendor's own security research and responsible-disclosure program rather than external report (ServiceNow, 2026-08-27). Three, CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820, are unauthenticated flaws in the ServiceNow AI Platform that ServiceNow's own text classifies as critical: CVE-2026-18885 as code injection letting an unauthenticated user execute arbitrary code and gain access to, or modify, instance data; CVE-2026-74820 as SQL injection letting an unauthenticated user execute arbitrary SQL against the instance's own database; CVE-2026-18886 also as code injection, but described as letting an unauthenticated user create or modify instance data, resulting in privilege escalation (ServiceNow, 2026-08-27). The Hacker News reports the same three at a numeric CVSS4.0 score of 10.0; ServiceNow's own advisory gives only the qualitative "critical" label, never a numeric score (The Hacker News, 2026-08-28). The Hacker News, reporting on the same advisory, assigns each a more specific mechanism: CVE-2026-18885 as a code injection in the GraphQL Composite Data API, CVE-2026-74820 as a SQL injection reached through a dynamic-schema ORDER BY clause, and CVE-2026-18886 as an improper-access-control flaw in the system-configuration image-upload processor enabling privilege escalation, a classification that differs from ServiceNow's own "code injection" description of the same id (The Hacker News, 2026-08-28). All three share the identical CVSS4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H per The Hacker News's reporting, network-reachable, low attack complexity, no privileges, no user interaction, high impact to the vulnerable component and connected systems (The Hacker News, 2026-08-28). A fourth, related flaw, CVE-2026-6876, is a sandbox escape ServiceNow's own text describes as letting an unauthenticated user execute arbitrary code within the Now Platform (ServiceNow, 2026-08-27). The Hacker News reports the CVSS4.0 vector ServiceNow assigned to it in fact specifies PR:L (low privileges required) rather than none (an inconsistency with ServiceNow's own "unauthenticated user" prose) scores it 8.7, and connects it to CVE-2026-6875, a pre-auth ServiceNow sandbox escape Searchlight Cyber reported to ServiceNow on 1 April 2026, with the vendor's own advisory for it published on 13 July 2026 (The Hacker News, 2026-08-28).

ServiceNow deployed the update to hosted instances directly and provided it to partner and self-hosted customers, who must apply it themselves; those customers should verify their instance version against the vendor's fixed-build table, spanning the Xanadu, Yokohama, Zurich and Australia release lines, each with its own minimum hotfix (The Hacker News, 2026-08-28). ServiceNow reports no awareness of exploitation for any of the four flaws, and The Hacker News found no public proof-of-concept for the three maximum-severity flaws as of 28 August 2026 (The Hacker News, 2026-08-28). Because ServiceNow is its own CVE Numbering Authority and none of the four flaws meet NIST's current post-April-2026 enrichment criteria (CISA KEV listing, federal-software impact, or an Executive Order 14028 critical designation), ServiceNow's own severity ratings are the only assessment on record for any of them (The Hacker News, 2026-08-28), a vulnerability-management process that ranks purely on NVD-enriched severity will not see the urgency here.

Detection concept: ServiceNow instance and application audit logs, and GraphQL API access logs, for anomalous or malformed API mutations originating from unauthenticated sessions; database-audit telemetry for dynamic-schema queries carrying non-schema tokens; system-configuration change-audit records for writes not tied to an authenticated administrative session. No public exploit code exists yet, so this is patch-priority guidance rather than an active-exploitation hunt.

Builds on: ServiceNow patches an unauthenticated code-execution sandbox escape in its AI Platform…

CVE-2026-6875, ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)

ServiceNow disclosed CVE-2026-6875, a "Sandbox Escape in ServiceNow AI Platform" rated CVSS 4.0 9.5, in security bulletin KB3137947 published 2026-07-13 (ServiceNow, 2026-07-13; ENISA EUVD, 2026-07-13). Per ServiceNow, the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform", an isolation failure in the AI Platform's code-execution environment. ServiceNow states it "addressed this vulnerability by deploying a security update to hosted instances," and provided updates to self-hosted customers and partners (ServiceNow, 2026-07-13). Fixed releases are Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2 and Brazil EA/GA (ServiceNow, 2026-07-13).

Contradiction: ServiceNow's advisory states that it is "not currently aware of exploitation against ServiceNow instances" (ServiceNow, 2026-07-13). BleepingComputer reported on 2026-07-20 that the advisory still said so and that ServiceNow had yet to flag the flaw as actively abused, and a ServiceNow spokesperson told it that, based on its investigation to date, it had not observed evidence that the activity is related to instances ServiceNow hosts (BleepingComputer, 2026-07-20). Defused reports in-the-wild exploitation attempts since 2026-07-17 (BleepingComputer, 2026-07-20), and NCSC-CH gives the exploitation status as actively exploited, citing that reporting (NCSC-CH, 2026-07-20).