Three Critical ServiceNow Flaws Expose Enterprises to Unauthenticated Code Execution

ServiceNow patched four security vulnerabilities in its AI Platform on August 27, 2026 — three rated CVSS 10.0 — that could allow unauthenticated attackers to execute arbitrary code and SQL against enterprise systems.

The severity of these flaws places them among the most dangerous vulnerabilities disclosed in 2026. Organizations running self-hosted ServiceNow instances face the greatest risk because they must apply patches manually rather than receiving automatic updates from ServiceNow's hosted deployment infrastructure.

What the Four Vulnerabilities Mean for Your Organization

The three maximum-severity flaws share an identical CVSS vector — network-reachable, low complexity, no privileges required, and no user interaction needed — with high impact across confidentiality, integrity, and availability. In plain terms, an attacker anywhere on the internet could potentially compromise a vulnerable instance without ever logging in.

The four CVEs disclosed in the August 27 advisory are:

• CVE-2026-18885 (CVSS 10.0): A code injection flaw in the GraphQL Composite Data API enabling unauthenticated arbitrary code execution and data access or modification
• CVE-2026-18886 (CVSS 10.0): An improper access control flaw in the system configuration image upload processor enabling unauthenticated privilege escalation
• CVE-2026-74820 (CVSS 10.0): A SQL injection vulnerability through a dynamic schema ORDER BY clause enabling unauthenticated arbitrary SQL execution against the underlying database
• CVE-2026-6876 (CVSS 8.7): A sandbox escape in the Now Platform enabling unauthenticated arbitrary code execution

Why the SQL Injection Flaw Deserves Particular Attention

The SQL injection flaw is particularly alarming. Attackers who can execute arbitrary SQL statements against a production database can extract sensitive records, alter data, or potentially move laterally into connected systems — gaining unrestricted access to your most sensitive operational data, and every system connected to it. For enterprises using ServiceNow to manage HR records, IT assets, or regulated data, the downstream consequences of a successful SQL injection attack could extend well beyond the platform itself. Organizations looking to understand their broader exposure should review strategies for preventing and responding to enterprise data breaches as part of their incident preparedness planning.

ServiceNow confirmed it deployed security updates to hosted instances and provided patches to partners and self-hosted customers. "We have provided updates and patches designed to address this issue and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so," a company spokesperson told The Hacker News.

Understanding the Attack Surface These Flaws Create

To appreciate the full risk, it helps to understand what these four CVEs collectively enable. An unauthenticated attacker with network access to a vulnerable ServiceNow instance could potentially chain these vulnerabilities — using the privilege escalation flaw in CVE-2026-18886 alongside the code execution capability in CVE-2026-18885 to establish persistent access, then leveraging CVE-2026-74820 to exfiltrate data from the underlying database. Each flaw is serious in isolation; in combination, they represent a near-complete compromise path requiring no credentials whatsoever.

The Exploitation Context Organizations Cannot Ignore

These four flaws do not exist in isolation. They follow CVE-2026-6875, a pre-authentication sandbox escape in the same platform reported to ServiceNow by Searchlight Cyber on April 1, 2026, and patched in a July 13 advisory.

Days after that July advisory, threat intelligence firm Defused reported observing in-the-wild exploitation of CVE-2026-6875. The firm later issued a correction noting the captured payload matched Searchlight Cyber's published proof-of-concept exploit rather than independently developed attack code.

ServiceNow responded directly to those exploitation reports. "Based on our investigation to date, we have not observed evidence that this activity is related to instances that ServiceNow hosts," the company spokesperson said. The company added that it would continue working directly with customers who need assistance applying patches.

The Window Between Disclosure and Patch Application

As of August 28, 2026, The Hacker News found no public exploit code for the three maximum-severity flaws. Searchlight Cyber's Adam Kues wrote in July that ServiceNow was "enhancing instance security by severely restricting the type of code that can run in sandbox contexts" — a measure that may reduce future attack surface if fully implemented.

The absence of public exploit code should not be mistaken for safety. Sophisticated threat actors routinely develop private exploits for high-severity vulnerabilities before proof-of-concept code reaches public repositories. The gap between patch release and patch application is precisely the window attackers target, and with CVSS 10.0 scores across three of these four flaws, that window carries exceptional risk. Conducting a thorough vulnerability assessment across your enterprise systems can help security teams prioritize remediation and identify exposure before attackers do.

Affected Versions and the Patch Gap Problem

ServiceNow identified affected versions across four platform release tracks. Organizations running any of the following without the specified hot fixes remain exposed:

• Xanadu: Any version before Patch 11 Hot Fix 7a
• Yokohama: Any version before Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4
• Zurich: Any version before several specific patch and hot fix combinations including Patch 12
• Australia: Any version before Patch 2 Hot Fix 3, Patch 3 Hot Fix 2, Patch 3m, Patch 4, or Patch 5

One important nuance exists in the record for CVE-2026-18886, where the status for "Australia Patch 5" is marked unknown rather than affected — unlike the other three CVEs, which mark the same version as affected.

The CISA Catalog Gap and What It Means for Risk Assessment

None of the four vulnerabilities appeared in CISA's Known Exploited Vulnerabilities catalog as of August 28, 2026. That absence carries administrative weight. Since April 15, 2026, NIST has enriched only vulnerabilities appearing in that catalog, affecting federal government software, or designated critical under Executive Order 14028. ServiceNow's own ratings therefore remain the only severity assessments on record — a gap that security teams evaluating risk through third-party frameworks should note.

ServiceNow is the CVE Numbering Authority for its own products, meaning it assigns and publishes severity scores without independent external verification in cases like this. Security teams should not allow the absence of a CISA catalog entry to reduce the urgency of their response. The CVSS 10.0 rating, the unauthenticated attack vector, and the platform's active exploitation history in 2026 collectively demand immediate action regardless of catalog status.

Steps Self-Hosted Customers Should Take Now

Enterprises relying on ServiceNow for IT service management, HR operations, or workflow automation should treat these patches as urgent. The combination of maximum severity scores, unauthenticated attack vectors, and a platform already targeted by active exploitation in 2026 leaves little room for delay.

Self-hosted customers should:

1. Audit patch status immediately against the affected version list above
2. Verify no unauthorized access occurred before applying patches, including reviewing authentication logs and database query histories for anomalous activity
3. Monitor network traffic to ServiceNow instances for unusual query patterns, particularly against GraphQL endpoints and schema-related API calls
4. Evaluate disclosure obligations if operating in regulated industries — these vulnerabilities may trigger notification requirements under applicable data protection frameworks

Organizations that have not yet established a formal process for tracking and responding to platform-level vulnerabilities should treat this incident as the catalyst to build one. Robust application and web security practices form the foundation of any defensible posture against the kind of unauthenticated, network-reachable attacks these CVEs enable.

The speed at which ServiceNow's platform has accumulated critical vulnerabilities in 2026 — from April's sandbox escape through to August's four-CVE advisory — signals that threat actors are actively probing this platform. Waiting to patch is not a neutral position; it is an active exposure decision with measurable consequences.