# ServiceNow vulnerabilities & exploitation > As of 2026-10-23, Threadlinqs tracks 12 ServiceNow CVEs, 0 in the CISA Known Exploited Vulnerabilities catalog, linked to 6 tracked threat campaigns. **Data as of:** 2026-10-23 ## Exploitation timeline Threadlinqs has recorded 12 ServiceNow CVEs published between 2025-07-15 and 2026-09-15. The busiest month was 2026-09 (5 new CVEs). None of them is listed in CISA KEV yet. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 12 of 12 tracked ServiceNow CVEs. - [CVE-2026-18886](https://intel.threadlinqs.com/cve/CVE-2026-18886) — CRITICAL 10 · EPSS 5% · 2026-08-27 - [CVE-2025-3648](https://intel.threadlinqs.com/cve/CVE-2025-3648) — HIGH 8.2 · EPSS 1.7% · 2025-07-08 - [CVE-2026-6876](https://intel.threadlinqs.com/cve/CVE-2026-6876) — CRITICAL 10 · EPSS 0.6% · 2026-08-27 - [CVE-2026-0542](https://intel.threadlinqs.com/cve/CVE-2026-0542) — CRITICAL 9.2 · EPSS 0.6% · 2026-02-25 - [CVE-2026-6875](https://intel.threadlinqs.com/cve/CVE-2026-6875) — CRITICAL 9.5 · EPSS 0.5% · 2026-07-13 - [CVE-2026-18885](https://intel.threadlinqs.com/cve/CVE-2026-18885) — CRITICAL 10 · EPSS 0.4% · 2026-08-27 - [CVE-2026-74820](https://intel.threadlinqs.com/cve/CVE-2026-74820) — CRITICAL 10 · EPSS 0.4% · 2026-08-27 - [CVE-2026-86860](https://intel.threadlinqs.com/cve/CVE-2026-86860) — CRITICAL 9.3 · EPSS 0.3% · 2026-09-24 - [CVE-2026-86859](https://intel.threadlinqs.com/cve/CVE-2026-86859) — HIGH 8.7 · EPSS 0.3% · 2026-09-24 - [CVE-2026-13016](https://intel.threadlinqs.com/cve/CVE-2026-13016) — CRITICAL 9.3 · EPSS 0.3% · 2026-09-24 - [CVE-2026-86858](https://intel.threadlinqs.com/cve/CVE-2026-86858) — HIGH 8.7 · EPSS 0.3% · 2026-09-24 - [CVE-2026-86857](https://intel.threadlinqs.com/cve/CVE-2026-86857) — HIGH 8.4 · EPSS 0.2% · 2026-09-24 ## Products affected Threadlinqs normalises CPE and CNA product records across all 12 CVEs; 2 distinct ServiceNow products are affected. The most frequently affected: - AI Platform — 11 CVEs - Now Platform — 1 CVE ## Threat activity 6 tracked threat campaigns reference ServiceNow products or exploit ServiceNow CVEs: - [Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses (CVE-2026-13016, CVE-2026-86857-86860)](https://intel.threadlinqs.com/threat/TL-2026-2653) — CRITICAL — 2026-09-25 - [ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876)](https://intel.threadlinqs.com/threat/TL-2026-2195) — CRITICAL — 2026-08-28 - ["City-Forum" Campaign Mass-Enumerates Salesforce Experience Cloud and ServiceNow Portals via Guest Access](https://intel.threadlinqs.com/threat/TL-2026-1999) — HIGH — 2026-08-12 - [Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context)](https://intel.threadlinqs.com/threat/TL-2026-1604) — MEDIUM — 2026-07-22 - [ServiceNow AI Platform Sandbox Escape Enables Unauthenticated Remote Code Execution (CVE-2026-6875)](https://intel.threadlinqs.com/threat/TL-2026-1305) — CRITICAL — 2026-07-14 - [ServiceNow Scripted REST Resource Unauthenticated Access - /api/now/related_list_edit/create](https://intel.threadlinqs.com/threat/TL-2026-0980) — CRITICAL — 2026-06-09 ## How to prioritise ServiceNow patching This order follows the data Threadlinqs holds for ServiceNow, not a generic severity checklist: - No ServiceNow CVE is in CISA KEV yet, so rank by exploit probability instead. - Outside KEV, the highest EPSS scores are [CVE-2026-18886](https://intel.threadlinqs.com/cve/CVE-2026-18886) (5%), [CVE-2025-3648](https://intel.threadlinqs.com/cve/CVE-2025-3648) (1.7%), [CVE-2026-6876](https://intel.threadlinqs.com/cve/CVE-2026-6876) (0.6%). - 8 CVEs score Critical and 4 High on CVSS v3 (maximum 10, average 9.3); sequence these after KEV and high-EPSS items. - 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-23 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/servicenow All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp