Exploitation timeline
Threadlinqs has recorded 12 ServiceNow CVEs published between and . The busiest month was 2026-09 (5 new CVEs). None of them is listed in CISA KEV yet.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 12 of 12 tracked ServiceNow CVEs.
- CVE-2026-18886critical 10EPSS 5%
- CVE-2025-3648high 8.2EPSS 1.7%
- CVE-2026-6876critical 10EPSS 0.6%
- CVE-2026-0542critical 9.2EPSS 0.6%
- CVE-2026-6875critical 9.5EPSS 0.5%
- CVE-2026-18885critical 10EPSS 0.4%
- CVE-2026-74820critical 10EPSS 0.4%
- CVE-2026-86860critical 9.3EPSS 0.3%
- CVE-2026-86859high 8.7EPSS 0.3%
- CVE-2026-13016critical 9.3EPSS 0.3%
- CVE-2026-86858high 8.7EPSS 0.3%
- CVE-2026-86857high 8.4EPSS 0.2%
Products affected
Threadlinqs normalises CPE and CNA product records across all 12 CVEs; 2 distinct ServiceNow products are affected. The most frequently affected:
- AI Platform 11 CVEs
- Now Platform 1 CVE
Threat activity
6 tracked threat campaigns reference ServiceNow products or exploit ServiceNow CVEs:
- Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses (CVE-2026-13016, CVE-2026-86857-86860)CRITICAL
- ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876)CRITICAL
- "City-Forum" Campaign Mass-Enumerates Salesforce Experience Cloud and ServiceNow Portals via Guest AccessHIGH
- Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context)MEDIUM
- ServiceNow AI Platform Sandbox Escape Enables Unauthenticated Remote Code Execution (CVE-2026-6875)CRITICAL
- ServiceNow Scripted REST Resource Unauthenticated Access - /api/now/related_list_edit/createCRITICAL
How to prioritise ServiceNow patching
This order follows the data Threadlinqs holds for ServiceNow, not a generic severity checklist:
- No ServiceNow CVE is in CISA KEV yet, so rank by exploit probability instead.
- Outside KEV, the highest EPSS scores are CVE-2026-18886 (5%), CVE-2025-3648 (1.7%), CVE-2026-6876 (0.6%).
- 8 CVEs score Critical and 4 High on CVSS v3 (maximum 10, average 9.3); sequence these after KEV and high-EPSS items.
- 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-23 and refresh daily.