ServiceNow patches three CVSS 10.0 flaws and raises a fourth to critical

ServiceNow has patched four vulnerabilities in the ServiceNow AI Platform and the Now Platform, three of them rated CVSS v4.0 10.0. The company published advisory KB3152242, its August 2026 CVE Advisory Notification, on 27 August 2026.

The three maximum-severity bugs are CVE-2026-18885, a code injection flaw in the GraphQL Composite Data API; CVE-2026-18886, an improper access control issue in the system configuration image upload processor; and CVE-2026-74820, a SQL injection flaw reached through a dynamically built schema ORDER BY clause.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Network reachable, low complexity, no privileges, no user interaction, and high impact on both the instance and the systems connected to it. ServiceNow says it is not currently aware of malicious exploitation against ServiceNow instances.

CVE-2026-6876 was published as a high-severity sandbox escape in the Now Platform with a CVSS v4.0 score of 8.7. That is the figure the late-August coverage carries, including SecurityWeek's report on 31 August. It is no longer current.

ServiceNow's live advisory now states that the company upgraded CVE-2026-6876 from high to critical after additional analysis from the researcher who discovered it, and that the change affects the severity rating only. The escalation landed in early September, after the first wave of reporting.

CVE-2026-18885 sits in the GraphQL Composite Data API. An unauthenticated request can lead to arbitrary code execution on the instance, along with access to or modification of instance data beyond the intended boundary.

CVE-2026-18886 is not code injection, despite coverage that groups all three under that label. ServiceNow classifies it as improper access control in the system configuration image upload processor, letting an unauthenticated user create or modify instance data and escalate privileges.

CVE-2026-74820 is SQL injection through a dynamic ORDER BY clause, which hands an unauthenticated attacker arbitrary SQL against the instance's underlying database. On a platform that sits next to HR records, vendor onboarding and finance approvals, that is a direct route to the data.

One inconsistency is worth flagging. For CVE-2026-6876, ServiceNow's text describes an unauthenticated user, while the published CVSS vector records PR:L, meaning low privileges required. The Hacker News and SOCRadar both noted the mismatch. It changes how you model the attacker, not whether you patch.

ServiceNow deployed the fix to its hosted instances, and customers in the ServiceNow Patching Program received the updates through that channel. Everyone else has work to do.

Self-hosted and partner-managed customers need to apply the hotfixes or upgrade to a patched release. ServiceNow lists fixed builds across four release families: Xanadu, Yokohama, Zurich and Australia. Applicability is per CVE and per release, so the exact patch and hot fix level decides whether you are covered, not the family name.

Do not stop at production. Development, test, clone and integration instances often hold production-like data, live credentials and trusted integrations, and those are the ones that quietly miss a patch cycle.

A ServiceNow instance is an integration hub. It holds workflow data plus credentials and trusted connections into the systems it automates, which is what makes unauthenticated code execution there worth more than the same bug in a standalone application.

History supports the concern. BleepingComputer recalls that in 2024 attackers chained three ServiceNow flaws using public exploits to steal data from companies and government agencies worldwide.

The pattern is recent too. CVE-2026-6875, a pre-authentication sandbox escape in the same platform, was patched on 13 July 2026 after Searchlight Cyber reported it in April. The Hacker News notes that Defused first reported in-the-wild exploitation, then corrected itself when the captured payload turned out to match Searchlight's published proof of concept. Even the false alarm shows how quickly payloads circulate once a fix is public.

Start with an inventory. List every instance you run, production and non-production, with its release family, patch level and hot fix level, then compare each one against the current KB3152242 table rather than against a summary in a news article.

Self-hosted instances come first, and among them the ones reachable from the internet. ServiceNow's advisory does not offer a compensating control that replaces the patch, so reducing network exposure buys time and nothing more.

After patching, verify the resulting build rather than trusting the change record. Then review instance logs for unexpected GraphQL calls, unusual admin activity and data exports over the window your instances stayed unpatched.

Watch KB3152242 itself. It has already changed once since publication, and the severity upgrade shows ServiceNow is still revising the record as researchers feed back analysis.

Then watch for proof-of-concept code. The Hacker News found none for the three maximum-severity flaws in the days after disclosure, and Searchlight Cyber had not published a technical write-up at that point. The July timeline for CVE-2026-6875 shows how short the gap between a public PoC and captured payloads can be.

A CISA KEV listing would be the clearest signal to escalate. None of these four CVEs had one at the time of writing.