Summary
- Three ServiceNow AI Platform flaws carry vendor-assigned CVSS 10.0 scores and are network-reachable without authentication.
- The vulnerabilities cover code injection, improper access control, and SQL injection, alongside a fourth sandbox-escape issue rated 8.7.
- ServiceNow says hosted instances were updated, while partners and self-hosted customers received fixes they must apply to their own deployments.
ServiceNow has patched three vulnerabilities in its AI Platform that it rates at the maximum CVSS score of 10.0, including flaws capable of unauthenticated code execution, privilege escalation, and arbitrary SQL execution against an instance database.
The company disclosed the vulnerabilities on 27 August as part of a four-flaw advisory. ServiceNow says it deployed security updates to instances it hosts and provided fixes to partners and customers operating their own deployments.
CVE-2026-18885 is a code-injection vulnerability in the GraphQL Composite Data API. According to ServiceNow’s assessment, an unauthenticated attacker can, in applicable circumstances, execute arbitrary code and gain access to or modify data held in an affected instance.
CVE-2026-18886 concerns improper access control in a system-configuration image-upload processor. The flaw can allow an unauthenticated attacker to create or modify instance data, resulting in privilege escalation.
The third maximum-severity issue, CVE-2026-74820, is an SQL-injection vulnerability involving a dynamic schema ordering function. ServiceNow says it can enable an unauthenticated attacker to execute arbitrary SQL statements against the database underlying an affected instance.
A fourth vulnerability, CVE-2026-6876, is rated 8.7 and concerns a sandbox escape in the Now Platform. ServiceNow’s published description says it can permit arbitrary code execution.
There is an inconsistency in the published technical information for that fourth flaw: its written description refers to an unauthenticated user, while the assigned CVSS vector records that low privileges are required. That discrepancy does not affect the three vulnerabilities rated 10.0.
Those maximum-severity scores are ServiceNow’s own assessments. Their vectors describe network-reachable attacks of low complexity requiring no privileges and no user interaction, with high potential impact to confidentiality, integrity, and availability.
Severity should not be confused with exploitation. ServiceNow says it is not currently aware of attacks using any of the four vulnerabilities disclosed in August, and none appeared in CISA’s Known Exploited Vulnerabilities catalogue as of 28 August.
That separates the new flaws from CVE-2026-6875, an earlier pre-authentication sandbox escape in the same platform. Cyber Insider covered the earlier issue in July after exploitation activity was reported. There is no evidence that the August vulnerabilities are part of that activity.
The latest disclosure creates a different exposure depending on how ServiceNow is deployed. The company can apply security updates directly to hosted instances, reducing the delay between remediation becoming available and reaching its managed estate.
Self-hosted organisations and partners remain responsible for applying supplied fixes to infrastructure they operate. Patch timing therefore depends on customer change processes, testing requirements, and the complexity of individual deployments.
That can become significant because ServiceNow often occupies a privileged position inside large organisations. Instances can contain service-management records, configuration data, user information, workflow logic, automation, integrations, and connections to other corporate systems.
Code execution or database-level access can consequently create exposure beyond the application function in which the original vulnerability sits. The actual impact depends on the affected version, instance configuration, integrations, and the data and privileges available within each environment.
The disclosure also illustrates a wider consequence of adding new capabilities to major enterprise platforms. AI functions join systems that already have extensive administrative and data-processing roles, increasing the number of interfaces and processing paths that need to remain inside the platform’s security boundary.
ServiceNow has published fixed patch levels across its Xanadu, Yokohama, Zurich, and Australia release families. With hosted instances updated, the remaining remediation question falls primarily on partners and organisations managing affected instances themselves.
