On 27 August 2026, ServiceNow published a security advisory describing four vulnerabilities in the ServiceNow AI Platform. Three of them — CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 — received the maximum score of 10.0 under CVSS v4 and, under certain conditions, can be exploited without authentication. The fourth vulnerability, CVE-2026-6876, is rated 8.7. Patches have already been deployed to ServiceNow-hosted instances, but organizations with self-hosted deployments must apply the updates manually. The Xanadu, Yokohama, Zurich and Australia releases are affected.
Technical analysis of the vulnerabilities
Three vulnerabilities with a CVSS 10.0 rating
All three maximally critical vulnerabilities share the same CVSS v4 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. This means the attack is performed over the network, has low complexity, requires no privileges, needs no user interaction, and has maximum impact on confidentiality, integrity and availability both for the vulnerable component and for related systems.
- CVE-2026-18885 — code injection in the GraphQL Composite Data API. Allows an unauthenticated user to execute arbitrary code and gain access to or modify instance data.
- CVE-2026-18886 — access control violation in the system configuration image upload handler. Allows creation or modification of instance data, leading to privilege escalation.
- CVE-2026-74820 — SQL injection via a dynamic ORDER BY construct in the data schema. Allows arbitrary SQL queries to be executed against the instance database.
The fourth vulnerability: sandbox escape
CVE-2026-6876 (CVSS 8.7) is described as a sandbox escape in Now Platform that allows arbitrary code execution. It is worth noting a contradiction in the description: the textual description from ServiceNow states that it can be exploited by an unauthenticated user, whereas the assigned CVSS vector contains the metric PR:L (low privileges required). Unlike the three previous vulnerabilities, the CVE-2026-6876 vector does not record impacts on systems beyond the vulnerable component.
Context: connection with a previous vulnerability
The August advisory appeared against the backdrop of the ongoing story around CVE-2026-6875 — a remote code execution vulnerability in the same platform disclosed on 13 July 2026. ServiceNow gave this vulnerability a CVSS v4 score of 9.5, with the only difference from the vector of the three new vulnerabilities being the attack complexity, which is set to high (AC:H) instead of low. Searchlight Cyber reportedly disclosed this vulnerability to ServiceNow back on 1 April 2026 and subsequently published a technical write-up with a proof of concept.
ServiceNow stated that, based on the results of its investigation, it found no evidence that activity related to CVE-2026-6875 affected instances hosted by the company. For each of the four new vulnerabilities, ServiceNow also indicated that, at the time the advisory was published, it was not aware of any active exploitation.
Risk assessment specifics
A critically important nuance: all CVSS ratings for the four new vulnerabilities are ServiceNow’s own assessments. The company is an authorized CNA (CVE Numbering Authority) for its own products. Since 15 April 2026, NIST has been enriching the NVD only with data on vulnerabilities from the CISA KEV catalog that affect federal software or are classified as critical under Executive Order 14028. As of 28 August 2026, none of the four vulnerabilities has been added to the CISA Known Exploited Vulnerabilities catalog, so there is no independent severity assessment.
This does not mean the scores are inflated, but organizations should bear in mind that the vendor itself is the sole source of the ratings. No public exploit code for the three vulnerabilities with a 10.0 rating had been found at the time of publication, but the existence of a PoC for the related CVE-2026-6875 shows that the research community is actively studying ServiceNow’s sandbox mechanisms.
Affected versions
According to the August ServiceNow advisory, the following versions are vulnerable:
- Xanadu — all versions up to Patch 11 Hot Fix 7a
- Yokohama — all versions up to Patch 12 Hot Fix 3b and up to Patch 13 Hot Fix 4
- Zurich — all versions up to Patch 7b Hot Fix 3, Patch 8 Hot Fix 5, Patch 9 Hot Fix 6, Patch 10 Hot Fix 2m (branch m), Patch 10 Hot Fix 3 (standard), Patch 11 or Patch 12
- Australia — all versions up to Patch 2 Hot Fix 3, Patch 3 Hot Fix 2, Patch 3m, Patch 4 or Patch 5
Versions not listed are by default considered unaffected. For CVE-2026-18886, the version “up to Australia Patch 5” is marked with the status “unknown”, whereas for the other three vulnerabilities the same version is marked as affected.
Recommendations
- Self-hosted instances: immediately check your current version and apply the relevant patches from the advisory. ServiceNow has already deployed updates to instances it hosts, but responsibility for self-hosted instances lies with their operators.
- Priority: the three vulnerabilities with a 10.0 rating affect fundamental components — the data access API, the configuration image upload handler and the SQL query mechanism. Exploiting any of them without authentication can lead to full compromise of the instance.
- Monitoring: track anomalous requests to the GraphQL API, atypical uploads through the configuration image handler, and suspicious patterns in SQL queries with dynamic ORDER BY constructs.
- Network segmentation: if immediate updating is not possible, restrict network access to ServiceNow instances, eliminating direct access from untrusted networks.
The combination of three vulnerabilities with maximum ratings, low attack complexity and no authentication requirements creates an extremely high level of risk for unprotected instances. Given that researchers have already demonstrated successful exploitation of ServiceNow’s sandbox mechanisms in the case of CVE-2026-6875, the appearance of exploits for the new vulnerabilities is only a matter of time. Organizations with self-hosted deployments should treat patching as a top-priority task and complete updates within the next few days.
