ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876) — Threadlinqs Intelligence
As of 2026-08-29, ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 21 indicators of compromise.
Threat ID: TL-2026-2195 · Severity: CRITICAL · CVSS: 10 · Status: PATCHED · Category: VULNERABILITY
Updated: 2026-08-29 · 2 updates · revalidated 2× · latest source
ServiceNow's August 27, 2026 advisory (KB3152242) discloses and patches four vulnerabilities in the Now Platform/AI Platform: three maximum-severity (CVSS v4.0 10.0) unauthenticated flaws — a GraphQL
On August 27, 2026, ServiceNow published its August 2026 CVE Advisory Notification (KB3152242), disclosing four vulnerabilities identified through internal security research and its responsible-disclosure program, and shipping hotfixes for all supported release families the same day.
Three of the four carry the maximum CVSS v4.0 base score of 10.0, each network-exploitable, low-complexity, and requiring no authentication or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H): CVE-2026-18885 is a CWE-94 code-injection flaw in the GraphQL Composite Data API that lets an unauthenticated attacker execute arbitrary code and read or modify instance data beyond intended limits — CISO Ensar Seker characterized it as transforming 'a trusted enterprise application into an attacker-controlled execution environment,' since exploitation requires no prior credential theft or employee compromise. CVE-2026-18886 is a CWE-284 improper-access-control flaw in the system configuration image upload processor that lets an unauthenticated attacker create or modify instance data, resulting in privilege escalation. CVE-2026-74820 is a CWE-89 SQL injection reachable through a dynamic schema ORDER BY clause, letting an unauthenticated attacker run arbitrary SQL against the instance's underlying database to read, alter, or destroy data.
The fourth, CVE-2026-6876 (CVSS v4.0 8.7; CWE-94, CWE-693, CWE-1284), is a sandbox-escape vulnerability in the Now Platform scripting sandbox: an attacker holding only low ('basic') privileges can break out of the sandbox to execute arbitrary code with broader platform access. ServiceNow's own scripting layer (Business Rules, Script Includes, and other server-side automation) runs as sandboxed server-side JavaScript, which is the execution context these code-injection and sandbox-escape flaws target.
ServiceNow states it is not currently aware of exploitation of any of the four flaws, and no public proof-of-concept has been reported for them. This disclosure follows two directly analogous, already-exploited precedents that establish ServiceNow's unauthenticated-API and scripting-sandbox flaws as a vulnerability class attackers weaponize rapidly. First: CVE-2026-6875, a separate pre-auth ServiceNow AI Platform sandbox-escape flaw reported by Searchlight Cyber's Assetnote team ('Smashing the ServiceNow Sandbox'), was patched for hosted instances in April 2026 and for self-hosted instances on July 13, 2026 (introducing the 'Guarded Script' sandbox-hardening runtime documented in KB2944435); attackers began exploiting it in the wild on July 18, 2026 — five days after the self-hosted patch shipped — using a sandbox-escape gadget different from the published PoC. Assetnote's technical writeup shows the escape abused ServiceNow's gs.include() script-include mechanism, which loads library scripts into a less-restricted execution context; by manipulating global JavaScript objects referenced by an included script, an attacker could get attacker-controlled code compiled and run outside the stricter sandbox — with full exploitation reaching table data, the ability to create administrator accounts, and the potential to execute commands on connected on-premises MID Server proxy systems. Second: in early June 2026, ServiceNow disclosed (KB3067321) that its Scripted REST API endpoint /api/now/related_list_edit/create had its requires_authentication flag set to false by default on the Australia release, letting unauthenticated requests run under the unprivileged Guest context; anomalous sweeps and data-harvesting activity against the endpoint were observed June 2-3, 2026, primarily from IP 51.159.98[.]241 (defanged in reporting; real value 51.159.98.241), including attempts to write to the sys_group_has_role table to append privileged administrative roles to default/demo groups as a persistence backdoor. ServiceNow shipped an emergency hosted-instance hotfix on June 5, 2026 but delayed public disclosure behind a g
Weaknesses (CWE)
CWE-94, CWE-284, CWE-89, CWE-693, CWE-1284
Target sectors: government administration, finance, health, technology, telecoms
Target regions: Global
Timeline
- ServiceNow discloses an earlier chainable trio of unauthenticated RCE flaws (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217); threat actors begin mass-scanning almost immediately and exploit them against private firms and government agencies, an earlier precedent for rapid weaponization of ServiceNow flaws.
- Searchlight Cyber's Assetnote team reports the unrelated but analogous pre-auth ServiceNow AI Platform sandbox-escape flaw CVE-2026-6875 ('Smashing the ServiceNow Sandbox'); ServiceNow begins remediating hosted instances in April 2026.
- Precise date not disclosed, reported as April 2026: the unauthenticated /api/now/related_list_edit/create API exposure later fixed as KB3067321 is reported to ServiceNow via its bug bounty program.
- Anomalous sweeps and data-harvesting activity begin against the unauthenticated /api/now/related_list_edit/create endpoint (KB3067321 precedent), primarily from IP 51.159.98.241, including attempts to write privileged roles into the sys_group_has_role table for persistence.
- ServiceNow applies an emergency hotfix (KB3067321) to hosted instances for the unauthenticated API exposure.
- ServiceNow publicly discloses KB3067321, but places the bulletin behind a gated support-portal login, drawing criticism for delayed transparency.
- ServiceNow silently ships a secondary update addressing a variant of the KB3067321 issue affecting two additional endpoints.
- ServiceNow ships self-hosted-instance security updates for CVE-2026-6875, introducing the Guarded Script sandbox-hardening feature (KB2944435).
- First in-the-wild exploitation of CVE-2026-6875 observed, five days after the self-hosted patch, using a sandbox-escape gadget distinct from the published PoC.
- Threat-intel firm Defused issues a correction on the related CVE-2026-6875 exploitation: closer analysis shows the captured payload was in fact identical to Searchlight Cyber's published proof-of-concept, not a distinct gadget chain as first reported; SecurityWeek separately notes the observed July 18 scanning activity may partly reflect security researchers probing for vulnerable instances rather than confirmed malicious actors.
- ServiceNow publishes its August 2026 CVE Advisory Notification (KB3152242), disclosing and patching CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, and CVE-2026-6876 across Xanadu, Yokohama, Zurich, and Australia releases; hosted instances are already remediated.
- The Hacker News, BleepingComputer, CSO Online, and GBHackers publish coverage of the three CVSS 10.0 unauthenticated flaws and the CVSS 8.7 sandbox escape.
Update History
- 2026-08-29 — Three CVSS 10.0 ServiceNow Now Platform Flaws Enable Unauthenticated Code Execution and SQL Injection (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820): What changed No genuine escalation: severity stays CRITICAL, exploitability stays THEORETICAL, attribution stays Unattributed/LOW. The newer report's 'ACTIVE' status field is a generic RESEARCH-phase default, not evidence of a status change
- 2026-08-29 — ServiceNow AI Platform: Three Maximum-Severity Vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) Plus High-Severity Sandbox Escape CVE-2026-6876: What changed No field escalations — severity (CRITICAL), cvss_score (10.0), exploitability (THEORETICAL), and attribution (LOW/Unknown) are unchanged and vendor still reports no observed exploitation of the four August CVEs. The newer repor
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 21 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876, T1595, T1190, T1059.007, T1098, T1136, T1548, T1213, T1565.001, T1588.005, T1595.002
