Three ServiceNow Vulnerabilities Rated CVSS 10.0 Open the Door to Remote Code Execution

On August 27, 2026, ServiceNow published a security advisory addressing four vulnerabilities in its AI platform. Three of them received the highest possible CVSS score — 10.0, and under certain conditions can be exploited by an attacker without authentication.

What was fixed

• CVE-2026-18885 (10.0) — code injection in the GraphQL Composite Data API: allows arbitrary code execution and access to, or modification of, instance data.
• CVE-2026-18886 (10.0) — improper access control in the configuration image upload handler: makes it possible to create or modify data and escalate privileges.
• CVE-2026-74820 (10.0) — SQL injection via dynamic ORDER BY construction: opens the door to running arbitrary SQL queries against the instance database.
• CVE-2026-6876 (8.7) — a Now Platform sandbox escape that allows arbitrary code execution.

All three vulnerabilities scored 10.0 share a single vector: a low-complexity network attack, requiring no privileges and no user interaction, with a high impact on the confidentiality, integrity, and availability of both the vulnerable component and the systems connected to it.

Who needs to act

ServiceNow said it has already rolled out the update to the instances it manages and delivered the fixes to partners and customers with their own infrastructure. Accordingly, organizations that maintain their own installations must apply the patches themselves. The advisory lists the affected versions of the Xanadu, Yokohama, Zurich, and Australia release lines, along with the specific patches and hotfixes.

According to the company, there were no signs of exploitation of any of the four vulnerabilities as of the time of publication. The Hacker News likewise found no public exploit code for the three critical vulnerabilities as of August 28. Researchers at Searchlight Cyber, who reported the flaws, have not yet released a technical breakdown.

Scores — from the vendor only

A curious detail: the 10.0 score was assigned by ServiceNow itself, which is the CVE Numbering Authority for its own products. Since April 15, 2026, NIST has supplemented with its own data only those vulnerabilities that have made it into CISA's Known Exploited Vulnerabilities catalog, affect federal agency software, or have been classified as critical under Executive Order 14028. None of the four vulnerabilities is in the catalog, so ServiceNow's scores remain the only official characterization of their severity.

The advisory comes shortly after the CVE-2026-6875 saga — also a sandbox escape in the same platform, which Searchlight Cyber reported back on April 1. Following a July publication, the firm Defused claimed it had observed exploitation, but then clarified: the intercepted payload matched the PoC published by the researchers. ServiceNow stressed that it had seen no indication this activity was connected to instances hosted with it.

Source: The Hacker News