ServiceNow Patches Multiple CVSS 10.0 Flaws

ServiceNow disclosed four vulnerabilities affecting its AI Platform and related Now Platform components on August 27, 2026. Three received vendor-assigned CVSS v4.0 scores of 10.0, while a fourth was rated 8.7 High. The issues could enable unauthenticated code execution, data modification, SQL statement execution, privilege escalation, or sandbox escape, depending on the vulnerability.

The vendor said it is not aware of malicious exploitation against ServiceNow instances as of disclosure, but self-hosted and partner-managed customers should verify patch status immediately.

Which ServiceNow Vulnerabilities Were Patched?

The three CVSS 10.0 issues share a severe vector: network reachability, low attack complexity, no attack requirements, no privileges required, no user interaction, and high impact across confidentiality, integrity, and availability.

CVE-2026-18885: GraphQL Composite Data API Code Injection

CVE-2026-18885 is a code-injection vulnerability in the GraphQL Composite Data API. The vendor describes it as a ServiceNow AI Platform flaw that could allow an unauthenticated user, in certain circumstances, to execute arbitrary code and access or modify instance data beyond what was intended.

Public material does not describe the exact resolver, validation issue, request structure, or exploit chain. The risk remains significant because GraphQL APIs can expose complex data and action paths when access controls or input handling fail.

CVE-2026-18886: System Configuration Image Upload Processor Flaw

CVE-2026-18886 is an improper-access-control issue in the system configuration image upload processor. The reported impact is that an unauthenticated user may be able to create or modify instance data and potentially escalate privileges.

CVE-2026-74820: Dynamic-Schema ORDER BY SQL Injection

CVE-2026-74820 is a SQL injection vulnerability involving a dynamic-schema ORDER BY clause. ServiceNow says it could allow an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance’s underlying database and access or modify instance data beyond what was intended.

The affected database engine, endpoint, access boundaries, and database-level limitations have not been publicly established. Defenders should avoid inferring exploit mechanics beyond the vendor description.

The fourth, less severe vulnerability (CVE-2026-6876) affects the Now Platform scripting sandbox and allows for a sandbox escape leading to arbitrary code execution. Rated CVSS v4.0 8.7 (High), it features a public scoring inconsistency where the vendor description mentions an unauthenticated user, yet the CVSS vector specifies low privileges required.

Which ServiceNow Versions Are Affected?

ServiceNow’s August 2026 advisory lists affected release families and fixed patch thresholds. Administrators should compare the complete release, patch, hot-fix, and branch level against KB3152242.

The CVE record for CVE-2026-18885 confirms these release families and states that releases not listed are treated as unaffected by default. A reported discrepancy also exists for CVE-2026-18886, where versions before Australia Patch 5 are marked unclear in supplied reporting. Confirm that issue directly through ServiceNow support or the current advisory.

Is There Active Exploitation?

No confirmed exploitation was identified for the four August vulnerabilities as of August 31, 2026.

A separate July vulnerability, CVE-2026-6875, was reportedly associated with exploitation attempts after disclosure. That activity does not demonstrate exploitation of the four August vulnerabilities, but it shows that ServiceNow issues can attract rapid scanning and research.

What Should Defenders Do Right Now?

Apply the security updates immediately. Prioritize exposed self-hosted and partner-managed deployments because customers are responsible for applying fixes in those environments.

Verify the exact patch level using KB3152242. A major-version upgrade alone does not prove remediation. Organizations using vendor-managed instances should confirm that ServiceNow deployed the relevant updates.

Review whether the GraphQL Composite Data API, configuration image processing, dynamic-schema functions, or scripting-related components are enabled and reachable. If patching is delayed, reduce unnecessary external access, apply network-layer protections, and segment ServiceNow infrastructure and connected systems. These controls should not replace vendor updates.

After patching, review privileged integrations, service identities, connected systems, administrative changes, and sensitive data access for unexpected activity.

How Can SOCRadar Help?

SOCRadar’s Cyber Threat Intelligence enables teams to monitor ServiceNow CVEs, severity updates, exploit activity, public PoC developments, and vendor advisories in real time.

Additionally, SOCRadar’s Attack Surface Management (ASM) provides critical exposure context by identifying internet-facing assets, exposed services, vulnerable software versions, domains, certificates, and digital infrastructure. Combining vulnerability intelligence with ASM allows security teams to effectively prioritize exposed instances and validate remediation across their environment.

How Can Defenders Hunt for Suspicious Activity?

Public reporting does not provide reliable signatures for the critical ServiceNow vulnerabilities, so detection should focus on behavior and audit evidence.

Review proxy, firewall, and WAF logs for unexpected unauthenticated requests to ServiceNow APIs or configuration-processing endpoints, abnormal GraphQL activity, malformed query structures, schema-enumeration activity, or requests from unfamiliar sources.

Review application, database, and ServiceNow audit logs for database errors, abnormal query timing, unusual data access, unexpected instance-record changes, new scripts, business rules, scheduled jobs, integrations, role changes, or administrative actions while the instance was unpatched.

For self-hosted environments, review endpoint, MID Server, and proxy telemetry for unexpected child processes, outbound connections, or unusual behavior from privileged integrations. Preserve logs, correlate activity with patch timelines, and investigate unexplained data or configuration changes.