# ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876)

> ServiceNow's August 27, 2026 advisory (KB3152242) discloses and patches four vulnerabilities in the Now Platform/AI Platform: three maximum-severity (CVSS v4.0 10.0) unauthenticated flaws — a GraphQL Composite Data API code injection (CVE-2026-18885), an image-upload-processor access-control bypass enabling privilege escalation (CVE-2026-18886), and a dynamic-schema ORDER BY SQL injection (CVE-2026-74820) — plus a high-severity (CVSS v4.0 8.7) low-privilege sandbox escape (CVE-2026-6876). ServiceNow reports no observed exploitation and no public PoC exists for any of the four.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-29T10:27:27.560Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2195
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-servicenow-multiple-maximum-severity-flaws-tl-2026-2195.webp?v=903cfbab (Threadlinqs threat intel: CVE-2026-18885 ServiceNow GraphQL RCE: Detection & IOCs (TL-2026-2195) — Critical severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-2195
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (1 shown free below)
- **CVEs:** CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876

## Description

On August 27, 2026, ServiceNow published its August 2026 CVE Advisory Notification (KB3152242), disclosing four vulnerabilities identified through internal security research and its responsible-disclosure program, and shipping hotfixes for all supported release families the same day.

Three of the four carry the maximum CVSS v4.0 base score of 10.0, each network-exploitable, low-complexity, and requiring no authentication or user interaction (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H): CVE-2026-18885 is a CWE-94 code-injection flaw in the GraphQL Composite Data API that lets an unauthenticated attacker execute arbitrary code and read or modify instance data beyond intended limits — CISO Ensar Seker characterized it as transforming 'a trusted enterprise application into an attacker-controlled execution environment,' since exploitation requires no prior credential theft or employee compromise. CVE-2026-18886 is a CWE-284 improper-access-control flaw in the system configuration image upload processor that lets an unauthenticated attacker create or modify instance data, resulting in privilege escalation. CVE-2026-74820 is a CWE-89 SQL injection reachable through a dynamic schema ORDER BY clause, letting an unauthenticated attacker run arbitrary SQL against the instance's underlying database to read, alter, or destroy data.

The fourth, CVE-2026-6876 (CVSS v4.0 8.7; CWE-94, CWE-693, CWE-1284), is a sandbox-escape vulnerability in the Now Platform scripting sandbox: an attacker holding only low ('basic') privileges can break out of the sandbox to execute arbitrary code with broader platform access. ServiceNow's own scripting layer (Business Rules, Script Includes, and other server-side automation) runs as sandboxed server-side JavaScript, which is the execution context these code-injection and sandbox-escape flaws target.

ServiceNow states it is not currently aware of exploitation of any of the four flaws, and no public proof-of-concept has been reported for them. This disclosure follows two directly analogous, already-exploited precedents that establish ServiceNow's unauthenticated-API and scripting-sandbox flaws as a vulnerability class attackers weaponize rapidly. First: CVE-2026-6875, a separate pre-auth ServiceNow AI Platform sandbox-escape flaw reported by Searchlight Cyber's Assetnote team ('Smashing the ServiceNow Sandbox'), was patched for hosted instances in April 2026 and for self-hosted instances on July 13, 2026 (introducing the 'Guarded Script' sandbox-hardening runtime documented in KB2944435); attackers began exploiting it in the wild on July 18, 2026 — five days after the self-hosted patch shipped — using a sandbox-escape gadget different from the published PoC. Assetnote's technical writeup shows the escape abused ServiceNow's gs.include() script-include mechanism, which loads library scripts into a less-restricted execution context; by manipulating global JavaScript objects referenced by an included script, an attacker could get attacker-controlled code compiled and run outside the stricter sandbox — with full exploitation reaching table data, the ability to create administrator accounts, and the potential to execute commands on connected on-premises MID Server proxy systems. Second: in early June 2026, ServiceNow disclosed (KB3067321) that its Scripted REST API endpoint /api/now/related_list_edit/create had its requires_authentication flag set to false by default on the Australia release, letting unauthenticated requests run under the unprivileged Guest context; anomalous sweeps and data-harvesting activity against the endpoint were observed June 2-3, 2026, primarily from IP 51.159.98[.]241 (defanged in reporting; real value 51.159.98.241), including attempts to write to the sys_group_has_role table to append privileged administrative roles to default/demo groups as a persistence backdoor. ServiceNow shipped an emergency hosted-instance hotfix on June 5, 2026 but delayed public disclosure behind a gated support-portal login until June 9, and silently patched a second, related two-endpoint variant on June 10.

That pattern of unauthenticated pre-auth exposure, rapid post-disclosure weaponization, and sandbox-escape severity is the primary reason this new, still-unexploited batch — especially CVE-2026-6876 in the same sandbox-escape class as CVE-2026-6875 — warrants active tracking despite the vendor's 'not currently aware of exploitation' assessment.

Affected releases span Xanadu, Yokohama, Zurich, and Australia branches; ServiceNow has already applied the fixes to its own hosted instances, but self-hosted customers must apply the hotfixes manually. No CISA KEV listing exists for any of the four CVEs as of this writing.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1098 Account Manipulation
- T1136 Create Account
- T1548 Abuse Elevation Control Mechanism
- T1213 Data from Information Repositories
- T1565.001 Stored Data Manipulation
- T1588.005 Obtain Capabilities: Exploits
- T1595.002 Active Scanning: Vulnerability Scanning
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1211 Exploitation for Defense Evasion
- T1528 Steal Application Access Token
- T1550.001 Use Alternate Authentication Material
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ServiceNow Privileged Role Injection into sys_group_has_role (Persistence Backdoor)** (`TL-2026-2195-SPL-002`)

Detects writes to the sys_group_has_role table that append administrator or other privileged roles to default/demo groups outside of change-managed activity, replicating the persistence technique observed in the June 2026 KB3067321 precedent incident and directly applicable to post-exploitation of CVE-2026-18886 or CVE-2026-6876.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1098, T1136, T1548
- **Data sources:** servicenow_audit_log, servicenow_sys_audit
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=servicenow sourcetype="servicenow:sys_audit" tablename="sys_group_has_role"
| eval action=lower(action)
| where action IN ("insert","update")
| lookup servicenow_privileged_roles.csv role_sys_id AS role OUTPUT role_name
| where match(role_name,"(?i)admin|security_admin|itil_admin")
| lookup servicenow_default_groups.csv group_sys_id AS group OUTPUT is_default_group
| where is_default_group="true"
| stats count min(_time) as first_seen values(user) as actor values(role_name) as roles by group
| where count > 0
```

### Microsoft KQL

```kql
ServiceNow_Audit_CL
| where TimeGenerated > ago(24h)
| where TableName_s == "sys_group_has_role"
| where Action_s in ("insert", "update")
| where RoleName_s has_any ("admin", "security_admin", "itil_admin")
| where IsDefaultGroup_b == true
| project TimeGenerated, ActorUser_s, GroupName_s, RoleName_s, SourceIPAddress_s
| summarize Writes = count(), Roles = make_set(RoleName_s) by ActorUser_s, GroupName_s
```

### Sigma

```yaml
title: ServiceNow Privileged Role Injection into sys_group_has_role
id: 5b8f3d21-7a9c-4e1b-8d6a-2f4c9b1e7a04
status: experimental
description: Detects administrative or security_admin role grants written to default/demo groups in sys_group_has_role, a persistence backdoor pattern observed in the KB3067321 precedent incident and applicable to post-exploitation of the August 2026 ServiceNow CVEs
references:
  - https://www.csoonline.com/article/4184082/servicenow-fixes-api-issue-after-reports-of-suspicious-tenant-activity.html
  - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
  - attack.persistence
  - attack.t1098
  - attack.t1136
  - attack.privilege-escalation
  - attack.t1548
logsource:
  category: application
  product: servicenow
  service: sys_audit
detection:
  selection_table:
    TableName: 'sys_group_has_role'
  selection_action:
    Action:
      - 'insert'
      - 'update'
  selection_role:
    RoleName|contains:
      - 'admin'
      - 'security_admin'
      - 'itil_admin'
  selection_group:
    IsDefaultGroup: true
  condition: selection_table and selection_action and selection_role and selection_group
falsepositives:
  - Change-managed role provisioning performed by authorized administrators against a linked change_request ticket
level: high
```

**Known false positives:**

- Legitimate role provisioning performed by authorized ServiceNow administrators through change-managed requests (correlate against the change_request table)

**Tuning notes:** Join against the change_request/sc_request tables to suppress role writes tied to an approved change ticket; flag default/demo/guest group sys_ids (e.g., employee_self_service_demo) as high-priority since they should rarely receive role grants.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ServiceNow Image Upload Processor Unauthenticated Access-Control Bypass (CVE-2026-18886) (locked: unlock with TL Creds)
- ServiceNow Scripting Sandbox Escape via gs.include() Gadget Abuse (CVE-2026-6876 class) (locked: unlock with TL Creds)
- Bulk Stored-Data Manipulation Across ServiceNow Instance Tables Post-Compromise (locked: unlock with TL Creds)
- ServiceNow Dynamic Schema ORDER BY SQL Injection Attempt (CVE-2026-74820) (locked: unlock with TL Creds)
- Unauthenticated Scripted REST API Sweep Against ServiceNow (requires_authentication=false pattern) (locked: unlock with TL Creds)
- Reconnaissance Sweep Against Unauthenticated ServiceNow Endpoints from Known Precedent Infrastructure (locked: unlock with TL Creds)
- ServiceNow [indicator] Code Injection Attempt (CVE-2026-18885) (locked: unlock with TL Creds)
- Anomalous MID Server Command Activity Following ServiceNow Sandbox Compromise (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 21)

Defanged, TLP:CLEAR.

- IP address: `51.159.98[.]241`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ServiceNow fixes critical flaws](https://cybersecuritynews.com/servicenow-fixes-critical-flaws/)
- [Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL](https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html)
- [August 2026 CVE Advisory Notification (KB3152242)](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242)
- [ServiceNow patches three maximum severity flaws that could put enterprise data at risk](https://www.csoonline.com/article/4215430/servicenow-patches-three-maximum-severity-flaws-that-could-put-enterprise-data-at-risk.html)
- [ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection](https://gbhackers.com/servicenow-patches-critical-flaws/)
- [ServiceNow warns of three max severity security vulnerabilities](https://www.bleepingcomputer.com/news/security/servicenow-warns-of-three-max-severity-security-vulnerabilities/)
- [NVD - CVE-2026-18885](https://nvd.nist.gov/vuln/detail/CVE-2026-18885)
- [NVD - CVE-2026-18886](https://nvd.nist.gov/vuln/detail/CVE-2026-18886)
- [NVD - CVE-2026-74820](https://nvd.nist.gov/vuln/detail/CVE-2026-74820)
- [NVD - CVE-2026-6876](https://nvd.nist.gov/vuln/detail/CVE-2026-6876)
- [CVE-2026-6875: ServiceNow Sandbox Escape to Pre-Auth RCE, exploited in the wild (related prior vulnerability)](https://www.helpnetsecurity.com/2026/07/20/servicenow-cve-2026-6875-exploited/)
- [Smashing the ServiceNow Sandbox – Pre Authentication RCE (Assetnote/Searchlight Cyber technical writeup on CVE-2026-6875)](https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/)
- [ServiceNow fixes API issue after reports of suspicious tenant activity (KB3067321 precedent incident)](https://www.csoonline.com/article/4184082/servicenow-fixes-api-issue-after-reports-of-suspicious-tenant-activity.html)
- [ServiceNow phases out Server-Side Sandbox: Guarded Scripts / Server-Side Sandbox Runtime update (KB2944435)](http://www.cloudminus89.com/2026/07/servicenow-phases-out-server-side.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2195