ServiceNow Patches 3 Critical Code Injection Vulnerabilities

August 31, 2026 at 06:59 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

ServiceNow has patched four vulnerabilities, including three critical code injection flaws in its AI platform, each rated CVSS 10. The flaws allow unauthenticated attackers to execute arbitrary code or SQL with low-complexity attacks. Hotfixes are available for Xanadu, Yokohama, Zurich, and Australia releases.

Key Facts

CVE-2026-18885 allows arbitrary code execution in the ServiceNow platform under certain circumstances.
CVE-2026-18886 is an improper access control issue that could allow an attacker to create or modify arbitrary data and elevate privileges.
CVE-2026-74820 is an SQL injection flaw that allows an attacker to execute arbitrary SQL statements against the underlying ServiceNow database.
CVE-2026-6876 is a high-severity sandbox escape weakness with a CVSS score of 8.7 that could be exploited without authentication for code execution within the Now Platform.
ServiceNow has rolled out patches for all four vulnerabilities across its hosted instances and released hotfixes for self-hosted instances.

Critical Vulnerabilities

ServiceNow has announced patches for four vulnerabilities, including three critical code injection flaws in the ServiceNow AI platform, each with a maximum severity CVSS score of 10/10. The first critical bug, CVE-2026-18885, allows an attacker to execute arbitrary code in the ServiceNow platform under certain circumstances. The second critical defect, CVE-2026-18886, is an improper access control issue that could allow an attacker to create or modify arbitrary data and elevate their privileges. The third critical vulnerability, CVE-2026-74820, is an SQL injection flaw that allows an attacker to execute arbitrary SQL statements against the underlying ServiceNow database. None of the three vulnerabilities requires authentication or user interaction, and all three can be exploited in low-complexity attacks.

Patch Availability

ServiceNow has rolled out patches for all four vulnerabilities across its hosted instances. The company also released hotfixes for self-hosted instances, encouraging customers to apply them as soon as possible. The hotfixes are available for ServiceNow's Xanadu, Yokohama, Zurich, and Australia releases. The fourth issue, CVE-2026-6876, is a high-severity sandbox escape weakness with a CVSS score of 8.7 that could be exploited without authentication for code execution within the Now Platform.

Security Response

Jason Brown, director of counter fraud operations at iCOUNTER, said security teams should prioritize patching their ServiceNow instances because attackers are quick to exploit newly discovered vulnerabilities. Brown noted that organizations running ServiceNow on their own infrastructure must find, schedule, and apply the patch themselves, a process that often takes weeks. He warned that during those weeks, an unauthenticated attacker with a working exploit for the GraphQL Composite Data API code injection bug or the SQL injection flaw has a real shot at systems that sit next to HR records, vendor onboarding, and finance approvals. Brown advised security teams running ServiceNow self-hosted to treat this as urgent and confirm the patch is applied this week, rather than waiting for the normal patch cycle.