ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876)

ServiceNow Patches Four Critical Flaws Including Three CVSS (TL-2026-2195) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-28 and last reviewed 2026-08-29. It has no confirmed attribution, affects ServiceNow Now Platform / AI Platform, references 4 CVEs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820), maps to 16 MITRE ATT&CK techniques (T1059.007, T1068, T1098), and is covered by 9 detection rules and 21 indicators of compromise.

Key facts for TL-2026-2195

Threat ID
TL-2026-2195
Severity
CRITICAL
CVSS
10 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Status
PATCHED
Category
VULNERABILITY
First published
2026-08-28
Last reviewed
2026-08-29
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, telecoms
Target regions
Global
Detection rules
9
Indicators of compromise
21
Updates
2026-08-29 · 2 updates · revalidated 2× · latest source

ServiceNow's August 27, 2026 advisory (KB3152242) discloses and patches four vulnerabilities in the Now Platform/AI Platform: three maximum-severity (CVSS v4.0 10.0) unauthenticated flaws — a GraphQL Composite Data API code injection (CVE-2026-18885), an image-upload-processor access-control bypass enabling privilege escalation (CVE-2026-18886), and a dynamic-schema ORDER BY SQL injection (CVE-2026-74820) — plus a high-severity (CVSS v4.0 8.7) low-privilege sandbox escape (CVE-2026-6876). ServiceNow reports no observed exploitation and no public PoC exists for any of the four.

How ServiceNow Patches Four Critical Flaws Including Three CVSS works

On August 27, 2026, ServiceNow published its August 2026 CVE Advisory Notification (KB3152242), disclosing four vulnerabilities identified through internal security research and its responsible-disclosure program, and shipping hotfixes for all supported release families the same day.

Three of the four carry the maximum CVSS v4.0 base score of 10.0, each network-exploitable, low-complexity, and requiring no authentication or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H): CVE-2026-18885 is a CWE-94 code-injection flaw in the GraphQL Composite Data API that lets an unauthenticated attacker execute arbitrary code and read or modify instance data beyond intended limits — CISO Ensar Seker characterized it as transforming 'a trusted enterprise application into an attacker-controlled execution environment,' since exploitation requires no prior credential theft or employee compromise. CVE-2026-18886 is a CWE-284 improper-access-control flaw in the system configuration image upload processor that lets an unauthenticated attacker create or modify instance data, resulting in privilege escalation. CVE-2026-74820 is a CWE-89 SQL injection reachable through a dynamic schema ORDER BY clause, letting an unauthenticated attacker run arbitrary SQL against the instance's underlying database to read, alter, or destroy data.

The fourth, CVE-2026-6876 (CVSS v4.0 8.7; CWE-94, CWE-693, CWE-1284), is a sandbox-escape vulnerability in the Now Platform scripting sandbox: an attacker holding only low ('basic') privileges can break out of the sandbox to execute arbitrary code with broader platform access. ServiceNow's own scripting layer (Business Rules, Script Includes, and other server-side automation) runs as sandboxed server-side JavaScript, which is the execution context these code-injection and sandbox-escape flaws target.

ServiceNow states it is not currently aware of exploitation of any of the four flaws, and no public proof-of-concept has been reported for them. This disclosure follows two directly analogous, already-exploited precedents that establish ServiceNow's unauthenticated-API and scripting-sandbox flaws as a vulnerability class attackers weaponize rapidly. First: CVE-2026-6875, a separate pre-auth ServiceNow AI Platform sandbox-escape flaw reported by Searchlight Cyber's Assetnote team ('Smashing the ServiceNow Sandbox'), was patched for hosted instances in April 2026 and for self-hosted instances on July 13, 2026 (introducing the 'Guarded Script' sandbox-hardening runtime documented in KB2944435); attackers began exploiting it in the wild on July 18, 2026 — five days after the self-hosted patch shipped — using a sandbox-escape gadget different from the published PoC. Assetnote's technical writeup shows the escape abused ServiceNow's gs.include() script-include mechanism, which loads library scripts into a less-restricted execution context; by manipulating global JavaScript objects referenced by an included script, an attacker could get attacker-controlled code compiled and run outside the stricter sandbox — with full exploitation reaching table data, the ability to create administrator accounts, and the potential to execute commands on connected on-premises MID Server proxy systems. Second: in early June 2026, ServiceNow disclosed (KB3067321) that its Scripted REST API endpoint /api/now/related_list_edit/create had its requires_authentication flag set to false by default on the Australia release, letting unauthenticated requests run under the unprivileged Guest context; anomalous sweeps and data-harvesting activity against the endpoint were observed June 2-3, 2026, primarily from IP 51.159.98[.]241 (defanged in reporting; real value 51.159.98.241), including attempts to write to the sys_group_has_role table to append privileged administrative roles to default/demo groups as a persistence backdoor. ServiceNow shipped an emergency hosted-instance hotfix on June 5, 2026 but delayed public disclosure behind a gated support-portal login until June 9, and silently patched a second, related two-endpoint variant on June 10.

That pattern of unauthenticated pre-auth exposure, rapid post-disclosure weaponization, and sandbox-escape severity is the primary reason this new, still-unexploited batch — especially CVE-2026-6876 in the same sandbox-escape class as CVE-2026-6875 — warrants active tracking despite the vendor's 'not currently aware of exploitation' assessment.

Affected releases span Xanadu, Yokohama, Zurich, and Australia branches; ServiceNow has already applied the fixes to its own hosted instances, but self-hosted customers must apply the hotfixes manually. No CISA KEV listing exists for any of the four CVEs as of this writing.

MITRE ATT&CK techniques used in TL-2026-2195

Execution

T1059.007 JavaScript

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism; T1611 Escape to Host

Persistence

T1098 Account Manipulation; T1136 Create Account

Initial Access

T1190 Exploit Public-Facing Application

Defense Evasion

T1211 Exploitation for Defense Evasion

Collection

T1213 Data from Information Repositories

Impact

T1485 Data Destruction; T1565.001 Stored Data Manipulation

Credential Access

T1528 Steal Application Access Token

Lateral Movement

T1550.001 Use Alternate Authentication Material

Resource Development

T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning

Affected products and versions in ServiceNow Patches Four Critical Flaws Including Three CVSS

  • ServiceNow — Now Platform / AI Platform
    Vulnerable versions: Xanadu pre-Patch 11 Hot Fix 7a; Yokohama pre-Patch 12 Hot Fix 3b; Yokohama pre-Patch 13 Hot Fix 4; Zurich Patch 7b Hot Fix 3 through pre-Patch 12 hotfix; Australia Patch 2 Hot Fix 3 through pre-Patch 5
    Fixed in: Xanadu Patch 11 Hot Fix 7a; Yokohama Patch 12 Hot Fix 3b; Yokohama Patch 13 Hot Fix 4; Zurich Patch 12 (August 2026 hotfix); Australia Patch 5

Remediation for ServiceNow Patches Four Critical Flaws Including Three CVSS

Patches

  • KB3152242 — ServiceNow August 2026 CVE Advisory Notification (all four CVEs)

Immediate actions

  • Apply ServiceNow's August 2026 hotfixes per KB3152242 without delay: Xanadu Patch 11 Hot Fix 7a; Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4; Zurich hotfix through Patch 12; Australia Patch 5
  • Self-hosted ServiceNow customers must apply the hotfix manually — ServiceNow has already remediated its own hosted instances
  • Review GraphQL Composite Data API and system configuration image-upload-processor access logs for unauthenticated or anomalous requests predating patch application
  • Given the June 2026 precedent (KB3067321), audit all Scripted REST API endpoints for a `requires_authentication` flag that defaults to false, and review sys_group_has_role and other role/permission tables for unexpected recent writes

Workarounds

  • ServiceNow has not published interim workarounds; vendor guidance is to apply the hotfixes directly

Longer-term hardening

  • Enable ServiceNow's Guarded Script feature (KB2944435, introduced with the related CVE-2026-6875 fix) to restrict what code can execute inside sandbox contexts
  • Restrict or WAF-front unauthenticated access to GraphQL and REST API endpoints where business requirements allow
  • Monitor connections and command activity between the instance and on-premises MID Server proxies for anomalous origin or timing
  • Track ServiceNow's monthly CVE Advisory Notifications on a fixed patch-review cadence given the platform's history of critical unauthenticated flaws

CVEs associated with ServiceNow Patches Four Critical Flaws Including Three CVSS

CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876

Weaknesses (CWE) in ServiceNow Patches Four Critical Flaws Including Three CVSS

CWE-94, CWE-284, CWE-89, CWE-693, CWE-1284

Timeline of ServiceNow Patches Four Critical Flaws Including Three CVSS

  • ServiceNow discloses an earlier chainable trio of unauthenticated RCE flaws (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217); threat actors begin mass-scanning almost immediately and exploit them against private firms and government agencies, an earlier precedent for rapid weaponization of ServiceNow flaws.
  • Searchlight Cyber's Assetnote team reports the unrelated but analogous pre-auth ServiceNow AI Platform sandbox-escape flaw CVE-2026-6875 ('Smashing the ServiceNow Sandbox'); ServiceNow begins remediating hosted instances in April 2026.
  • Precise date not disclosed, reported as April 2026: the unauthenticated /api/now/related_list_edit/create API exposure later fixed as KB3067321 is reported to ServiceNow via its bug bounty program.
  • Anomalous sweeps and data-harvesting activity begin against the unauthenticated /api/now/related_list_edit/create endpoint (KB3067321 precedent), primarily from IP 51.159.98.241, including attempts to write privileged roles into the sys_group_has_role table for persistence.
  • ServiceNow applies an emergency hotfix (KB3067321) to hosted instances for the unauthenticated API exposure.
  • ServiceNow publicly discloses KB3067321, but places the bulletin behind a gated support-portal login, drawing criticism for delayed transparency.
  • ServiceNow silently ships a secondary update addressing a variant of the KB3067321 issue affecting two additional endpoints.
  • ServiceNow ships self-hosted-instance security updates for CVE-2026-6875, introducing the Guarded Script sandbox-hardening feature (KB2944435).
  • First in-the-wild exploitation of CVE-2026-6875 observed, five days after the self-hosted patch, using a sandbox-escape gadget distinct from the published PoC.
  • Threat-intel firm Defused issues a correction on the related CVE-2026-6875 exploitation: closer analysis shows the captured payload was in fact identical to Searchlight Cyber's published proof-of-concept, not a distinct gadget chain as first reported; SecurityWeek separately notes the observed July 18 scanning activity may partly reflect security researchers probing for vulnerable instances rather than confirmed malicious actors.
  • ServiceNow publishes its August 2026 CVE Advisory Notification (KB3152242), disclosing and patching CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, and CVE-2026-6876 across Xanadu, Yokohama, Zurich, and Australia releases; hosted instances are already remediated.
  • NHS England Digital issues cyber alert cc-4839 covering the ServiceNow advisory for UK healthcare/government ServiceNow deployments.
  • BleepingComputer cites an industry expert warning that attackers could begin exploitation attempts within roughly 15 minutes of the advisory's publication, despite no confirmed active exploitation.
  • The Hacker News, BleepingComputer, CSO Online, and GBHackers publish coverage of the three CVSS 10.0 unauthenticated flaws and the CVSS 8.7 sandbox escape.
  • ServiceNow states it is not currently aware of exploitation of any of the four newly disclosed CVEs, and no public PoC has been reported.
  • Cyber Security News publishes coverage; TL-Intel hunt ingests the disclosure from RSS feeds.

Update history for TL-2026-2195

Sources cited for ServiceNow Patches Four Critical Flaws Including Three CVSS

More in vulnerability

Detection coverage for TL-2026-2195

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2195 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats