VulnerabilitiesAug 28, 2026

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

ServiceNow patches four critical vulnerabilities, three rated CVSS 10.0, allowing unauthenticated code and SQL

Vendor Watch

Run ServiceNow?

Get an email when a reviewed story names ServiceNow, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

Summary

ServiceNow has released patches for four security flaws in its AI Platform, with three vulnerabilities receiving a critical CVSS 10.0 rating. These flaws, including code injection, improper access control, and SQL injection, could allow unauthenticated attackers to execute arbitrary code, modify instance data, and escalate privileges. The company has updated hosted instances and provided patches to partners and self-hosted customers, urging them to apply the fixes.

The lesson from this incident

Full lesson

Three critical vulnerabilities in ServiceNow's AI Platform — including code injection, SQL injection, and improper access control — received the maximum CVSS score of 10.0, meaning unauthenticated attackers could fully compromise affected instances without any credentials. The root problem lies in inadequate input validation and missing authentication enforcement on sensitive endpoints, two foundational secure-coding failures. Self-hosted customers face the greatest risk because they must manually apply patches, unlike hosted instances that were updated automatically. This incident underscores how enterprise platforms handling sensitive business data can become single points of catastrophic failure when patch cycles lag behind disclosed vulnerabilities.

What helps against this

How we list vendors

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleTenable Vulnerability Management Holm Security Platform Axonius Exposures all options
Automated patch management
Known holes get closed in days, not months.
For exampleAction1 Patch Management Microsoft Intune Ivanti Neurons for Patch Management all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleDataminr Agentic Threat Intelligence Platform Google Threat Intelligence Recorded Future Cyber Operations all options

Indicators of Compromise

cve — CVE-2026-18885
cve — CVE-2026-18886
cve — CVE-2026-74820
cve — CVE-2026-6876
cve — CVE-2026-6875

Entities

ServiceNow AI Platform (product)Now Platform (product)ServiceNow (vendor)