ServiceNow patches three CVSS 10.0 vulnerabilities: unauthenticated RCE and SQL injection on the AI platform
ServiceNow published a security advisory on August 27 patching three CVSS 10.0 vulnerabilities in its AI platform. Unauthenticated attackers can execute arbitrary code, escalate to admin, and run SQL against the underlying database.
ServiceNow's patch action drew attention: on August 27 ServiceNow published a security advisory fixing four vulnerabilities on the AI platform, three of them CVSS v4.0 10.0. All three critical issues are network-reachable, low-complexity, unauthenticated, and require no user interaction.
Incident overview
The advisory covers ServiceNow AI Platform and Now Platform — four CVEs:
- CVE-2026-18885 (CVSS 10.0): GraphQL Composite Data API code injection. Unauthenticated attackers can execute arbitrary code and access or modify instance data;
- CVE-2026-18886 (CVSS 10.0): access-control flaw in the system-configuration image-upload handler. Unauthenticated attackers can create or modify data and escalate to administrator;
- CVE-2026-74820 (CVSS 10.0): SQL injection in the ORDER BY clause of dynamic schema queries; arbitrary SQL against the underlying database;
- CVE-2026-6876 (CVSS 8.7): Now Platform script sandbox escape, leading to arbitrary code execution.
The three critical issues share the same CVSS vector profile: network-reachable, low attack complexity, no privileges, no interaction; high impact on confidentiality, integrity, and availability.
Technical details
ORDER BY injection is a classic parameterization gap — values in WHERE are usually parameterized; sort fields often are not. This bug uses that gap to reach the underlying database. The GraphQL Composite Data API injection point lets malicious input ride inside composite requests that merge multiple data operations, reaching code execution.
Impact assessment
ServiceNow hosts ITSM, HR, and workflow for many Fortune 500 companies. Instances typically hold incident data, asset inventories, CMDB, employee records, and credentials for connected systems. As of August 28, the vendor reported no in-the-wild exploitation and no public exploit code — but given history (attackers previously chained three ServiceNow bugs for mass data theft), the window after a PoC appears is not to be underestimated.
Remediation
- Cloud-hosted instances: ServiceNow has rolled out the fix; confirm the instance received the update;
- Self-hosted instances: upgrade per the official patch matrix, including Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b / Patch 13 Hot Fix 4, Zurich Patch 7b Hot Fix 3 and later, Australia Patch 2 Hot Fix 3 and later, and corresponding versions;
- Check whether the instance is internet-reachable; consider tightening management-interface access;
- Watch for PoC publication; re-verify patch coverage as soon as public exploit code appears.
Sources
- SecurityOnline: CVE-2026-18885 (CVSS 10) analysis
- Secure ISS: ServiceNow official advisory highlights
- ServiceNow security advisory (2026-08-27)