ServiceNow has addressed four serious security flaws in its AI Platform, three of which are rated as maximum severity (10.0) and could allow unauthenticated attackers to run code or tamper with critical data. These patches, rolled out to hosted and self-managed instances, tackle different types of threats including SQL and code injection.
The advisory, issued on August 27, 2026, details four vulnerabilities:
- CVE-2026-18885: A code injection issue in the GraphQL Composite Data API that allows an unauthenticated actor to run arbitrary code and potentially access or modify instance data.
- CVE-2026-18886: Improper access control in the image upload processor, enabling unauthenticated users to alter or create data, risking privilege escalation.
- CVE-2026-74820: SQL injection via a dynamic schema ORDER BY clause, granting full SQL control over the instance’s database by an unauthenticated attacker.
- CVE-2026-6876: A sandbox escape in the Now Platform, rated 8.7, where an unauthenticated user could run arbitrary code—but this flaw has slightly lower severity metrics than the others.
Affected Versions & Fix Status
All versions of ServiceNow’s Xanadu, Yokohama, Zurich, and Australia releases are vulnerable unless updated to specific patch levels. Examples include:
- Xanadu: versions before Patch 11 Hot Fix 7a.
- Yokohama: any version before Patch 12 Hot Fix 3b or before Patch 13 Hot Fix 4.
- Zurich: versions preceding Patch 7b Hot Fix 3, Patch 8 Hot Fix 5, through to Patch 12 depending on branch.
- Australia: versions before Patch 2 Hot Fix 3, Patch 3 Hot Fix 2 (or m), Patch 4, or Patch 5, depending on branch.
ServiceNow has already deployed fixes to its hosted cloud instances. Self-hosted customers are responsible for applying the updates on their own. According to the advisory, none of these vulnerabilities are currently known to be exploited in the wild. Public proof-of-concepts are also not available as of August 28, 2026.
Severity, Scoring, and Recent History
The three worst vulnerabilities have identical CVSS vectors indicating no user interaction required, no privileges needed, and a low attack complexity. They threaten confidentiality, integrity, and availability of both the vulnerable component and connected systems. These ratings were assigned by ServiceNow itself; since April 15, 2026, third-party assignment via NIST has only been applied to certain high-priority vulnerabilities. None of the four new flaws appear in CISA’s Known Exploited Vulnerabilities catalog yet, leaving ServiceNow’s assessments as the primary source of severity.
This patch batch comes just weeks after a similar issue, CVE-2026-6875, was disclosed in July. That flaw also involved a pre-authentication sandbox escape and was reportedly being actively exploited. ServiceNow and security researchers worked quickly to surface a fix then.
For organizations running on ServiceNow, the path forward is clear: verify your version, apply the patches immediately if you fall below the fixed version thresholds, and monitor for any unusual behavior during and after updates.
What this means: As enterprise systems increasingly rely on cloud-based AI platforms, vulnerabilities that require no authentication and offer full code or database access are among the most dangerous. These ServiceNow flaws illustrate the growing risk in complex, interconnected systems. Going forward, we’ll be watching how enterprises accelerate patch cycles and how threat actors respond—with stealthy exploitation or by targeting self-hosted environments slower to update.
