ServiceNow Patches Three CVSS 10.0 Flaws — Unauthenticated Attackers Could Execute Code and Run SQL
- The Mess: ServiceNow has patched four vulnerabilities affecting its AI Platform, including three rated CVSS 10.0. Under certain circumstances, the flaws could allow an unauthenticated attacker to execute arbitrary code, manipulate instance data or run SQL commands against the underlying database. ServiceNow says it is not currently aware of active exploitation of the newly disclosed vulnerabilities.
- The Damage: A pre-authentication compromise of a ServiceNow instance can put enterprise workflows, sensitive data and administrative processes in the same blast radius.
- The Fix: Hosted instances received ServiceNow’s security update, while affected self-hosted customers and partners need to apply the relevant fixes and verify their instance version.
Three vulnerabilities.
Three CVSS 10.0 scores.
And in all three cases, the attacker may not need an account.
That’s the part that should get administrators moving.
The Three Maximum-Severity Bugs
ServiceNow’s August 27 advisory covers four vulnerabilities affecting the AI Platform.
Three received the maximum CVSS v4.0 score of 10.0:
- CVE-2026-18885 — code injection in the GraphQL Composite Data API that could allow an unauthenticated attacker to execute arbitrary code and access or modify instance data.
- CVE-2026-18886 — improper access control in the system configuration image-upload processor that could allow an unauthenticated attacker to create or modify instance data and potentially escalate privileges.
- CVE-2026-74820 — SQL injection involving a dynamic schema
ORDER BYclause that could allow an unauthenticated attacker to execute arbitrary SQL statements against the underlying database.
A fourth issue, CVE-2026-6876, received a CVSS score of 8.7 and concerns a sandbox escape that could enable code execution within the Now Platform.
That is not a subtle patch Tuesday.
No Account. No Click. No Permission.
The three CVSS 10.0 vulnerabilities share an ugly set of characteristics.
According to the published severity vectors, they are network-reachable, require low attack complexity, no privileges and no user interaction.
Translated into normal language:
the attacker may not need to steal a password first.
They may not need to convince an employee to open a file.
They may not need an existing ServiceNow account.
If the vulnerable attack path is exposed and the required conditions exist, the entry point can begin directly from the network.
That’s why a 10.0 score gets attention.
Not because the number looks dramatic.
Because the attack prerequisites can be dangerously small.
The GraphQL Problem
CVE-2026-18885 is particularly interesting.
The vulnerability affects the GraphQL Composite Data API and is described as a code-injection issue that could allow arbitrary code execution and access to or modification of instance data.
For an enterprise platform, that’s a nasty combination.
Code execution is bad.
Data access is bad.
Data modification is bad.
Put them together and the attacker may potentially move from:
“I found an exposed endpoint.”
to:
“I can influence what happens inside the instance.”
That’s a very different incident.
SQL Injection Is Still Here
Then there is CVE-2026-74820.
Yes.
In 2026.
SQL injection.
The flaw reportedly involves a dynamic schema ORDER BY clause and could allow an unauthenticated attacker to execute arbitrary SQL statements against the instance’s underlying database.
SQL injection is one of those vulnerabilities that refuses to die.
Applications change.
Frameworks change.
Infrastructure moves to the cloud.
AI gets bolted onto everything.
And somewhere, an unsafe database query is still waiting for someone to feed it the wrong input.
If the attack works as described, this isn’t merely about reading one forgotten database field.
SQL access can potentially mean:
reading data.
modifying records.
deleting information.
Depending on the environment and database permissions, the consequences can become much larger.
The Image Upload Bug Is Also a Serious Problem
CVE-2026-18886 affects the system configuration image-upload processor.
The issue involves improper access control and could allow an unauthenticated attacker to create or modify instance data, potentially resulting in privilege escalation.
Image uploads have a long history of causing security problems.
Administrators often think:
“It’s just an upload form.”
Attackers see:
“It’s code that accepts input and processes files.”
That difference in perspective has produced plenty of incidents over the years.
Why ServiceNow Is an Attractive Target
ServiceNow isn’t just another application sitting on a server.
For many organizations, it sits in the middle of important business processes.
IT operations.
Security workflows.
Incident management.
Asset management.
Employee requests.
Automation.
Approvals.
Potentially sensitive internal data.
That makes a compromised instance much more interesting than a random vulnerable website.
The attacker isn’t necessarily looking for the ServiceNow server itself.
They may be looking for what the platform connects to.
The AI Platform Makes the Timing Interesting
These vulnerabilities affect ServiceNow’s AI Platform.
That matters because enterprise platforms are becoming increasingly interconnected.
AI systems don’t live in isolation.
They consume data.
Trigger workflows.
Interact with users.
Connect to business systems.
The more capabilities attached to one platform, the more interesting that platform becomes when something breaks.
A vulnerability in an isolated application is one problem.
A vulnerability in software sitting between users, workflows, data and automation is potentially another.
There Is No Known Active Exploitation Yet
This part is important.
ServiceNow says it is not currently aware of active exploitation of the four newly disclosed vulnerabilities. As of August 28, they also were not listed in CISA’s Known Exploited Vulnerabilities catalog, and no public exploit code for the three CVSS 10.0 issues had been identified in the reporting reviewed.
So this is not another:
“Patch immediately because attackers are already burning the Internet.”
At least not yet.
But that doesn’t make it a low-priority patch.
The disclosure itself provides attackers with something valuable:
a target.
And now researchers, defenders and criminals all know exactly where to look.
Hosted Customers and Self-Hosted Customers Are Not in the Same Position
ServiceNow says it deployed the security update to hosted instances and made the fixes available to partners and self-hosted customers.
That creates the usual split.
If ServiceNow hosts and manages your affected environment, the update process is largely handled by the provider.
If you operate a self-hosted deployment or manage an affected environment yourself, somebody still needs to make sure the fix actually gets applied.
And that’s where security incidents often begin.
Not because there was no patch.
Because there was.
And nobody installed it.
Check the Version Before Someone Else Does
The advisory affects specific patch levels across multiple ServiceNow releases, including Xanadu, Yokohama, Zurich and Australia.
The exact fixed version depends on the release branch, so administrators should compare their instance against ServiceNow’s published remediation levels rather than assuming that a vaguely recent update is enough.
This is not the moment for:
“I think we patched ServiceNow a few months ago.”
Check.
Actually check.
Because three 10.0 vulnerabilities are a good reason to stop trusting your memory.
CVSS 10.0 Doesn’t Mean Instant Catastrophe
There is one thing worth keeping in perspective.
A maximum CVSS score does not mean every ServiceNow customer is already compromised.
It does not mean every deployment is equally exposed.
And it does not mean exploitation is guaranteed.
But it does mean the potential impact and attack characteristics are serious enough that ignoring the patch would be a strange risk decision.
Especially when the attacker may not need credentials.
Bugstoday Opinion
The most interesting part here isn’t simply that ServiceNow has three new CVSS 10.0 vulnerabilities.
We’re starting to see the same pattern again and again.
The platforms becoming more central to the enterprise are also becoming more attractive targets.
One platform handles workflows.
Another manages identities.
Another connects applications.
Another runs AI agents.
Eventually someone finds a bug in the middle of all that connectivity.
And suddenly the vulnerability isn’t just about compromising one server.
It’s about what that server can reach.
The good news is that there is currently no confirmed active exploitation of these three CVSS 10.0 flaws.
The bad news?
Now everyone knows about them.
Bugstoday verdict: three maximum-severity vulnerabilities affecting an enterprise platform are not something to leave for the next maintenance window. ServiceNow says the new flaws are not currently known to be exploited, which means defenders still have the advantage. The question is how long they intend to keep it.
