Skip to navigation

Threat reportVulnerabilityTL-2026-2195

ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876)

criticalPATCHED

ServiceNow's August 27, 2026 advisory (KB3152242) discloses and patches four vulnerabilities in the Now Platform/AI Platform: three maximum-severity (CVSS v4.0 10.0) unauthenticated flaws — a GraphQL Composite Data API code injection (CVE-2026-18885), an image-upload-processor access-control bypass enabling privilege escalation (CVE-2026-18886), and a dynamic-schema ORDER BY SQL injection (CVE-2026-74820) — plus a high-severity (CVSS v4.0 8.7) low-privilege sandbox escape (CVE-2026-6876).

Key facts for ServiceNow multiple maximum-severity flaws

IdentifiersTL-2026-2195, CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876
SeverityCRITICAL
CVSS10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Exploitation statusNo exploitation observed (theoretical)
EPSSCVE-2026-18886: 5.0% (92.0th percentile); CVE-2026-6876: 0.6% (48.0th percentile); CVE-2026-18885: 0.4% (35.6th percentile)
Affected productsServiceNow Now Platform / AI Platform
Weaknesses (CWE)CWE-94, CWE-284, CWE-89, CWE-693, CWE-1284
MITRE ATT&CK techniquesT1059.007 JavaScript, T1068 Exploitation for Privilege Escalation, T1098 Account Manipulation, T1136 Create Account, T1190 Exploit Public-Facing Application, T1211 Exploitation for Defense Evasion, T1213 Data from Information Repositories, T1485 Data Destruction, T1528 Steal Application Access Token, T1548 Abuse Elevation Control Mechanism, T1550.001 Use Alternate Authentication Material, T1565.001 Stored Data Manipulation and 4 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment administration, finance, health, technology, telecoms
Target regionsGlobal
Detection rules9 (1 shown free)
Sources14 cited sources

Detection coverage for ServiceNow multiple maximum-severity flaws

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2195 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ServiceNow Privileged Role Injection into sys_group_has_role (Persistence Backdoor)

Detects writes to the sys_group_has_role table that append administrator or other privileged roles to default/demo groups outside of change-managed activity, replicating the persistence technique observed in the June 2026 KB3067321 precedent incident and directly applicable to post-exploitation of CVE-2026-18886 or CVE-2026-6876.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1098, T1136, T1548
  • Data sources: servicenow_audit_log, servicenow_sys_audit
  • Severity: high
  • Confidence: medium

Splunk SPL

index=servicenow sourcetype="servicenow:sys_audit" tablename="sys_group_has_role"
| eval action=lower(action)
| where action IN ("insert","update")
| lookup servicenow_privileged_roles.csv role_sys_id AS role OUTPUT role_name
| where match(role_name,"(?i)admin|security_admin|itil_admin")
| lookup servicenow_default_groups.csv group_sys_id AS group OUTPUT is_default_group
| where is_default_group="true"
| stats count min(_time) as first_seen values(user) as actor values(role_name) as roles by group
| where count > 0

Microsoft KQL

ServiceNow_Audit_CL
| where TimeGenerated > ago(24h)
| where TableName_s == "sys_group_has_role"
| where Action_s in ("insert", "update")
| where RoleName_s has_any ("admin", "security_admin", "itil_admin")
| where IsDefaultGroup_b == true
| project TimeGenerated, ActorUser_s, GroupName_s, RoleName_s, SourceIPAddress_s
| summarize Writes = count(), Roles = make_set(RoleName_s) by ActorUser_s, GroupName_s

Sigma

title: ServiceNow Privileged Role Injection into sys_group_has_role
id: 5b8f3d21-7a9c-4e1b-8d6a-2f4c9b1e7a04
status: experimental
description: Detects administrative or security_admin role grants written to default/demo groups in sys_group_has_role, a persistence backdoor pattern observed in the KB3067321 precedent incident and applicable to post-exploitation of the August 2026 ServiceNow CVEs
references:
  - https://www.csoonline.com/article/4184082/servicenow-fixes-api-issue-after-reports-of-suspicious-tenant-activity.html
  - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
  - attack.persistence
  - attack.t1098
  - attack.t1136
  - attack.privilege-escalation
  - attack.t1548
logsource:
  category: application
  product: servicenow
  service: sys_audit
detection:
  selection_table:
    TableName: 'sys_group_has_role'
  selection_action:
    Action:
      - 'insert'
      - 'update'
  selection_role:
    RoleName|contains:
      - 'admin'
      - 'security_admin'
      - 'itil_admin'
  selection_group:
    IsDefaultGroup: true
  condition: selection_table and selection_action and selection_role and selection_group
falsepositives:
  - Change-managed role provisioning performed by authorized administrators against a linked change_request ticket
level: high

Known false positives:

  • Legitimate role provisioning performed by authorized ServiceNow administrators through change-managed requests (correlate against the change_request table)

Tuning notes: Join against the change_request/sc_request tables to suppress role writes tied to an approved change ticket; flag default/demo/guest group sys_ids (e.g., employee_self_service_demo) as high-priority since they should rarely receive role grants.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ServiceNow Image Upload Processor Unauthenticated Access-Control Bypass (CVE-2026-18886) · unlock with TL Creds
  • ServiceNow Scripting Sandbox Escape via gs.include() Gadget Abuse (CVE-2026-6876 class) · unlock with TL Creds
  • Bulk Stored-Data Manipulation Across ServiceNow Instance Tables Post-Compromise · unlock with TL Creds
  • ServiceNow Dynamic Schema ORDER BY SQL Injection Attempt (CVE-2026-74820) · unlock with TL Creds
  • Unauthenticated Scripted REST API Sweep Against ServiceNow (requires_authentication=false pattern) · unlock with TL Creds
  • Reconnaissance Sweep Against Unauthenticated ServiceNow Endpoints from Known Precedent Infrastructure · unlock with TL Creds
  • ServiceNow [indicator] Code Injection Attempt (CVE-2026-18885) · unlock with TL Creds
  • Anomalous MID Server Command Activity Following ServiceNow Sandbox Compromise · unlock with TL Creds

Indicators of compromise for ServiceNow multiple maximum-severity flaws

As of 2026-08-29, Threadlinqs Intelligence tracks 21 indicators of compromise for TL-2026-2195.

Sample indicators (1 of 21)

  • IP address: 51.159.98[.]241

Defanged, TLP:CLEAR. Full set of 21 indicators: unlock with TL Creds.

21 indicators of compromise · unlock with TL Creds. Compare plans

How ServiceNow multiple maximum-severity flaws works

ServiceNow reports no observed exploitation and no public PoC exists for any of the four.

On August 27, 2026, ServiceNow published its August 2026 CVE Advisory Notification (KB3152242), disclosing four vulnerabilities identified through internal security research and its responsible-disclosure program, and shipping hotfixes for all supported release families the same day.

Three of the four carry the maximum CVSS v4.0 base score of 10.0, each network-exploitable, low-complexity, and requiring no authentication or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H): CVE-2026-18885 is a CWE-94 code-injection flaw in the GraphQL Composite Data API that lets an unauthenticated attacker execute arbitrary code and read or modify instance data beyond intended limits — CISO Ensar Seker characterized it as transforming 'a trusted enterprise application into an attacker-controlled execution environment,' since exploitation requires no prior credential theft or employee compromise. CVE-2026-18886 is a CWE-284 improper-access-control flaw in the system configuration image upload processor that lets an unauthenticated attacker create or modify instance data, resulting in privilege escalation. CVE-2026-74820 is a CWE-89 SQL injection reachable through a dynamic schema ORDER BY clause, letting an unauthenticated attacker run arbitrary SQL against the instance's underlying database to read, alter, or destroy data.

The fourth, CVE-2026-6876 (CVSS v4.0 8.7; CWE-94, CWE-693, CWE-1284), is a sandbox-escape vulnerability in the Now Platform scripting sandbox: an attacker holding only low ('basic') privileges can break out of the sandbox to execute arbitrary code with broader platform access. ServiceNow's own scripting layer (Business Rules, Script Includes, and other server-side automation) runs as sandboxed server-side JavaScript, which is the execution context these code-injection and sandbox-escape flaws target.

ServiceNow states it is not currently aware of exploitation of any of the four flaws, and no public proof-of-concept has been reported for them. This disclosure follows two directly analogous, already-exploited precedents that establish ServiceNow's unauthenticated-API and scripting-sandbox flaws as a vulnerability class attackers weaponize rapidly. First: CVE-2026-6875, a separate pre-auth ServiceNow AI Platform sandbox-escape flaw reported by Searchlight Cyber's Assetnote team ('Smashing the ServiceNow Sandbox'), was patched for hosted instances in April 2026 and for self-hosted instances on July 13, 2026 (introducing the 'Guarded Script' sandbox-hardening runtime documented in KB2944435); attackers began exploiting it in the wild on July 18, 2026 — five days after the self-hosted patch shipped — using a sandbox-escape gadget different from the published PoC. Assetnote's technical writeup shows the escape abused ServiceNow's gs.include() script-include mechanism, which loads library scripts into a less-restricted execution context; by manipulating global JavaScript objects referenced by an included script, an attacker could get attacker-controlled code compiled and run outside the stricter sandbox — with full exploitation reaching table data, the ability to create administrator accounts, and the potential to execute commands on connected on-premises MID Server proxy systems. Second: in early June 2026, ServiceNow disclosed (KB3067321) that its Scripted REST API endpoint /api/now/related_list_edit/create had its requires_authentication flag set to false by default on the Australia release, letting unauthenticated requests run under the unprivileged Guest context; anomalous sweeps and data-harvesting activity against the endpoint were observed June 2-3, 2026, primarily from IP 51.159.98[.]241 (defanged in reporting; real value 51.159.98.241), including attempts to write to the sys_group_has_role table to append privileged administrative roles to default/demo groups as a persistence backdoor. ServiceNow shipped an emergency hosted-instance hotfix on June 5, 2026 but delayed public disclosure behind a gated support-portal login until June 9, and silently patched a second, related two-endpoint variant on June 10.

That pattern of unauthenticated pre-auth exposure, rapid post-disclosure weaponization, and sandbox-escape severity is the primary reason this new, still-unexploited batch — especially CVE-2026-6876 in the same sandbox-escape class as CVE-2026-6875 — warrants active tracking despite the vendor's 'not currently aware of exploitation' assessment.

Affected releases span Xanadu, Yokohama, Zurich, and Australia branches; ServiceNow has already applied the fixes to its own hosted instances, but self-hosted customers must apply the hotfixes manually. No CISA KEV listing exists for any of the four CVEs as of this writing.

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 JavaScript

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Persistence

T1098 Account Manipulation; T1136 Create Account

Initial Access

T1190 Exploit Public-Facing Application

Defense Evasion

T1211 Exploitation for Defense Evasion

Collection

T1213 Data from Information Repositories

Impact

T1485 Data Destruction; T1565.001 Stored Data Manipulation

Credential Access

T1528 Steal Application Access Token

Lateral Movement

T1550.001 Use Alternate Authentication Material

Resource Development

T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

Remediation for ServiceNow multiple maximum-severity flaws

Patches

  • KB3152242 — ServiceNow August 2026 CVE Advisory Notification (all four CVEs)

Immediate actions

  • Apply ServiceNow's August 2026 hotfixes per KB3152242 without delay: Xanadu Patch 11 Hot Fix 7a; Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4; Zurich hotfix through Patch 12; Australia Patch 5
  • Self-hosted ServiceNow customers must apply the hotfix manually — ServiceNow has already remediated its own hosted instances
  • Review GraphQL Composite Data API and system configuration image-upload-processor access logs for unauthenticated or anomalous requests predating patch application
  • Given the June 2026 precedent (KB3067321), audit all Scripted REST API endpoints for a `requires_authentication` flag that defaults to false, and review sys_group_has_role and other role/permission tables for unexpected recent writes

Workarounds

  • ServiceNow has not published interim workarounds; vendor guidance is to apply the hotfixes directly

Longer-term hardening

  • Enable ServiceNow's Guarded Script feature (KB2944435, introduced with the related CVE-2026-6875 fix) to restrict what code can execute inside sandbox contexts
  • Restrict or WAF-front unauthenticated access to GraphQL and REST API endpoints where business requirements allow
  • Monitor connections and command activity between the instance and on-premises MID Server proxies for anomalous origin or timing
  • Track ServiceNow's monthly CVE Advisory Notifications on a fixed patch-review cadence given the platform's history of critical unauthenticated flaws

Affected and fixed versions

  • ServiceNow — Now Platform / AI Platform
    Vulnerable versions: Xanadu pre-Patch 11 Hot Fix 7a; Yokohama pre-Patch 12 Hot Fix 3b; Yokohama pre-Patch 13 Hot Fix 4; Zurich Patch 7b Hot Fix 3 through pre-Patch 12 hotfix; Australia Patch 2 Hot Fix 3 through pre-Patch 5
    Fixed in: Xanadu Patch 11 Hot Fix 7a; Yokohama Patch 12 Hot Fix 3b; Yokohama Patch 13 Hot Fix 4; Zurich Patch 12 (August 2026 hotfix); Australia Patch 5

Timeline of ServiceNow multiple maximum-severity flaws

Last updated · 2 updates · revalidated 2× · latest source

  • locked-ioc-17 discloses an earlier chainable trio of unauthenticated RCE flaws (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217); threat actors begin mass-scanning almost immediately and exploit them against private firms and government agencies, an earlier precedent for rapid weaponization of locked-ioc-17 flaws.
  • Searchlight Cyber's Assetnote team reports the unrelated but analogous pre-auth locked-ioc-12 sandbox-escape flaw CVE-2026-6875 ('Smashing the locked-ioc-17 Sandbox'); locked-ioc-17 begins remediating hosted instances in April 2026.
  • Precise date not disclosed, reported as April 2026: the unauthenticated /api/now/related_list_edit/create API exposure later fixed as locked-ioc-19 is reported to locked-ioc-17 via its bug bounty program.
  • Anomalous sweeps and data-harvesting activity begin against the unauthenticated /api/now/related_list_edit/create endpoint (locked-ioc-19 precedent), primarily from IP locked-ioc-16, including attempts to write privileged roles into the sys_group_has_role table for persistence.
  • locked-ioc-17 applies an emergency hotfix (locked-ioc-19) to hosted instances for the unauthenticated API exposure.
  • locked-ioc-17 publicly discloses locked-ioc-19, but places the bulletin behind a gated support-portal login, drawing criticism for delayed transparency.
  • locked-ioc-17 silently ships a secondary update addressing a variant of the locked-ioc-19 issue affecting two additional endpoints.
  • locked-ioc-17 ships self-hosted-instance security updates for CVE-2026-6875, introducing the Guarded Script sandbox-hardening feature (KB2944435).
  • First in-the-wild exploitation of CVE-2026-6875 observed, five days after the self-hosted patch, using a sandbox-escape gadget distinct from the published PoC.
  • Threat-intel firm locked-ioc-21 issues a correction on the related CVE-2026-6875 exploitation: closer analysis shows the captured payload was in fact identical to Searchlight Cyber's published proof-of-concept, not a distinct gadget chain as first reported; SecurityWeek separately notes the observed July 18 scanning activity may partly reflect security researchers probing for vulnerable instances rather than confirmed malicious actors.
  • locked-ioc-17 publishes its August 2026 CVE Advisory Notification (KB3152242), disclosing and patching CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, and CVE-2026-6876 across Xanadu, Yokohama, Zurich, and Australia releases; hosted instances are already remediated.
  • locked-ioc-14 issues cyber alert cc-4839 covering the locked-ioc-17 advisory for UK healthcare/government locked-ioc-17 deployments.
  • BleepingComputer cites an industry expert warning that attackers could begin exploitation attempts within roughly 15 minutes of the advisory's publication, despite no confirmed active exploitation.
  • The Hacker News, BleepingComputer, CSO Online, and GBHackers publish coverage of the three CVSS 10.0 unauthenticated flaws and the CVSS 8.7 sandbox escape.
  • locked-ioc-17 states it is not currently aware of exploitation of any of the four newly disclosed CVEs, and no public PoC has been reported.
  • Cyber Security News publishes coverage; TL-Intel hunt ingests the disclosure from RSS feeds.

Update history

Sources cited for ServiceNow multiple maximum-severity flaws

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats