Full research report
ServiceNow warns of three max severity security vulnerabilities
Executive assessment
ServiceNow's August 2026 advisory discloses three unauthenticated CVSS 10.0 vulnerabilities spanning code injection and SQL injection across distinct platform components, representing a broad attack surface for the world's most widely deployed enterprise workflow platform. Cloud tenants received automatic patches on 27 August 2026, narrowing the vulnerable population to organisations running self-managed Xanadu, Yokohama, Zurich, or Australia deployments. No public proof-of-concept exists at time of research and ServiceNow reports no known exploitation; however, the 2024 precedent with CVE-2024-4879 — added to CISA KEV within days of disclosure and weaponised in a global reconnaissance campaign — demonstrates that threat actors treat this platform as a high-value target and move quickly once PoC code becomes available. The additional sandbox-escape flaw CVE-2026-6876, requiring only low-privileged access, presents a credible escalation path if an attacker obtains even minimal platform credentials. Immediate patching verification for self-hosted instances, combined with anomaly monitoring on the specific API endpoints identified in the advisory, is the highest-priority defensive action until independent exploitation evidence clarifies the real-world risk trajectory.
What happened
On 27 August 2026, ServiceNow published advisory KB3152242 disclosing four vulnerabilities in its AI Platform (formerly Now Platform): three rated CVSS 10.0 (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) and one rated CVSS 8.7 (CVE-2026-6876). The company states the flaws were identified through internal research and responsible disclosure and that no malicious exploitation has been observed. Cloud-hosted tenants received automatic patches; self-hosted operators must apply updates manually.
Affected scope
ServiceNow AI Platform across the Xanadu, Yokohama, Zurich, and Australia release lines. Specific patched versions include Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 and 13 variants, Zurich Patch 7b through Patch 12, and Australia Patch 2 through Patch 5. The platform underpins more than 100,000 enterprise AI applications at approximately 85% of Fortune 500 companies.
Technical assessment
CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API permitting unauthenticated arbitrary code execution and unauthorised data access or modification. CVE-2026-18886 is an improper access control weakness in the system configuration image upload processor enabling unauthenticated creation or modification of instance data and privilege escalation. CVE-2026-74820 is an SQL injection reachable via a dynamic schema ORDER BY clause allowing unauthenticated execution of arbitrary SQL against the underlying database. CVE-2026-6876 is a sandbox escape in the Now Platform requiring low-privileged access and enabling remote code execution. The three critical flaws require no authentication and no user interaction, making opportunistic mass-scanning a realistic near-term threat given prior behaviour on this platform.
Recommended defensive actions
- Apply vendor patches immediately for all self-hosted Xanadu, Yokohama, Zurich, and Australia release instances per ServiceNow advisory KB3152242; cloud instances were automatically updated on 27 August 2026
- Verify patch application by confirming instance version strings against the fixed release matrix published in KB3152242 before considering the risk resolved
- Monitor ServiceNow access logs for anomalous unauthenticated GraphQL API requests, unexpected configuration image upload activity, and atypical SQL query patterns as early exploitation indicators
- Restrict network-level access to ServiceNow instances to authorised IP ranges where operationally feasible to limit unauthenticated attack surface until patching is complete
- Subscribe to ServiceNow Security Advisory notifications to receive timely disclosure of future critical patches and reduce response latency
Uncertainties and evidence gaps
- ServiceNow advisory KB3152242 requires authentication to access directly; the full patch matrix and any nuanced exploitation conditions could not be read from the vendor source and are taken from secondary reporting
- No independent security researcher has published detailed technical analysis of the three new CVEs; exploitation complexity assessments rely on vendor-provided descriptions
- The EPSS score of 0.99976 in the source material applies to CVE-2024-4879 (2024), not the new 2026 CVEs; no EPSS data for the new CVEs was available at time of research
- CVE-2026-6876 authentication requirements are inconsistently described across sources; BleepingComputer and the CVSS vector indicate low-privileged access is required, while at least one outlet incorrectly characterised it as unauthenticated
Vulnerability flow
Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.
No confirmed active exploitation of the four newly patched CVEs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876); ServiceNow stated on 28 August 2026 it is not currently aware of malicious exploitation. CVE-2024-4879 was previously exploited in chained attacks confirmed by CISA KEV in July 2024.
Investigation began with the BleepingComputer article and the CISA KEV entry for CVE-2024-4879, which established that this story covers newly disclosed 2026 CVEs alongside a historically exploited 2024 flaw. Searches quickly identified the vendor advisory KB3152242 and multiple independent outlets providing consistent technical detail. Fetching The Hacker News, CSO Online, and Techzine articles provided component-level vulnerability descriptions corroborated across three separate domains. A targeted search for public proof-of-concept code returned nothing, supporting the conclusion that exploitation risk for the new CVEs is elevated by severity and platform attractiveness but has not yet been confirmed in the wild.
- What are the full details of the new ServiceNow vulnerabilities and which sources cover this story?Fetched the BleepingComputer article linked in source materialbleepingcomputer.com ↗
Confirmed four CVEs: three CVSS 10.0 (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) and one CVSS 8.7 (CVE-2026-6876); ServiceNow reports no known exploitation; historical 2024 three-vulnerability chain referenced
why Established baseline event facts and identified vendor advisory reference KB3152242 for follow-up verification
- Which other outlets cover this story and what is the vendor advisory URL?Searched for the ServiceNow advisory and independent coverage of the four CVEs
Vendor advisory KB3152242 confirmed by search results; independent coverage from The Hacker News, CSO Online, Techzine, and GBHackers; no evidence of PoC or exploitation discussion in results
why Multiple independent outlets citing the same KB number and CVE details corroborate the vendor disclosure; breadth of coverage confirms this is a significant event
- What are the precise technical components affected by each CVE?Fetched The Hacker News article for independent technical detailthehackernews.com ↗
CVE-2026-18885: GraphQL Composite Data API; CVE-2026-18886: system configuration image upload processor; CVE-2026-74820: dynamic schema ORDER BY clause; CVE-2026-6876 CVSS vector indicates low privileges required, conflicting with some unauthenticated characterisations
why Component-level detail from a second independent source enables defenders to scope audit and detection effort to specific platform areas
- Does CSO Online add any context not present in other sources?Fetched CSO Online articlecsoonline.com ↗
Confirmed all CVE and CVSS details; expert commentary notes exploitation of high-profile enterprise platforms typically begins within minutes of disclosure
why Third independent source corroborates technical details and adds urgency context that strengthens the patching priority recommendation
- Is there any public proof-of-concept or active exploitation evidence for the new 2026 CVEs?Searched for PoC code, exploit repositories, and exploitation reports for the four new CVEs
No public proof-of-concept or exploitation evidence found for CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, or CVE-2026-6876 as of 28 August 2026
why Absence of public PoC reduces immediate exploitation likelihood but does not eliminate risk; the 2024 precedent shows PoC and active scanning emerged within days of prior ServiceNow disclosures
- What is the historical exploitation context of CVE-2024-4879 for threat-actor assessment?Searched for CVE-2024-4879 exploitation history and the 2024 chained-attack campaign
CVE-2024-4879 (Jelly template injection) was chained with CVE-2024-5217 and CVE-2024-5178 in a 2024 global reconnaissance campaign; CISA added all three to KEV on 29 July 2024; threat actors sold stolen organisational data publicly following exploitation
why Establishes that ServiceNow is a proven high-value target with a track record of rapid exploitation after PoC publication; directly motivates prompt manual patching for self-hosted instances
- Do the new 2026 CVEs appear on CISA KEV, and does Techzine add deployment context?Searched CISA KEV for the new CVE identifiers and fetched Techzine articletechzine.eu ↗
No CISA KEV entries found for any of the four new CVEs, consistent with ServiceNow's no-known-exploitation statement; Techzine confirms cloud tenants were automatically patched on 27 August 2026 and self-hosted operators must patch manually
why The cloud-versus-self-hosted distinction is the most operationally significant fact for defenders: cloud customers are already protected while self-hosted operators carry residual risk requiring immediate action
Research coverage
All 73 registered source leaves were evaluated for this run: 66 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 62 completed sources contained no matched information for this story.
Complete source-by-source audit 73 sources
| Source | Run result | Value | Why it was useful — or not |
|---|---|---|---|
| BleepingComputernews | ok9 records | Primary evidence1 matched items | Published the source report used to frame and date the event. |
| CISA KEVkev | ok1685 records | Primary evidence1 matched items | Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue. |
| NVDcve | ok900 records | Corroborating1 matched items | A page from this source was opened and verified during focused research. |
| FIRST EPSSepss | ok | Context1 matched items | Added exploitation-probability context; EPSS does not itself prove exploitation. |
| AlienVault OTXdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CERT-EU Threat Intelligencenews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| CIRCL CVEcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| CISA Alertsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Cisco PSIRTvendor_advisory | ok5333 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Cisco Talosnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| deepdarkCTI CVE most exploiteddeepdarkcti | ok94 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Discorddeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI exploitsdeepdarkcti | ok24 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI forumsdeepdarkcti | ok264 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware as a servicedeepdarkcti | ok7 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI malware samplesdeepdarkcti | ok3 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI marketsdeepdarkcti | ok127 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI phishingdeepdarkcti | ok19 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI ransomware gangsdeepdarkcti | ok687 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI RATsdeepdarkcti | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram infostealerdeepdarkcti | ok130 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Telegram threat actorsdeepdarkcti | ok1012 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| deepdarkCTI Twitter threat actorsdeepdarkcti | ok39 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Exploit-DBexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Fortinet PSIRTvendor_advisory | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| GitHub topic: cveresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: exploitresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: penetration-testingresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: pocresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GitHub topic: vulnerabilityresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| GreyNoiseexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| KrebsOnSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| LinkedIn RSS proxy feeds (disabled)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| MalwareBazaardark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cveresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #cybersecurityresearch | ok15 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #exploitresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #infosecresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #malwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #ransomwareresearch | ok20 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #threatintelresearch | ok12 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Mastodon #vulnerabilityresearch | ok18 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Metasploit module metadataexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Microsoft MSRCvendor_advisory | ok1591 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Microsoft Securitynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP Galaxyresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| MISP threat actor galaxyactor | ok0 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Palo Alto Networks PSIRTvendor_advisory | ok25 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ProjectDiscovery nuclei templatesexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Rapid7news | ok2 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Reddit r/AskNetsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/cybersecurity (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/malware (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/netsec (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| Reddit r/ReverseEngineering (pending API approval)research | disabled | Disabled | Disabled in the source registry; no check was attempted. |
| SANS ISCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| SentinelLabsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shadowserver public aggregate honeypot observationsexploit_reference | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Shodanresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sigma Rulesresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Sophos X-Opsnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The DFIR Reportnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| The Hacker Newsnews | ok13 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| ThreatFoxthreat_intelligence | ok100 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| UK NCSCnews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| Unit 42news | ok1 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Unit42 IOCsresearch | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
| URLhausdark_web | ok10 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VirusTotal Community IOC enrichmentresearch | ok4 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| VulnCheck KEVkev | ok500 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| Vulnerability Lookupcve | ok30 records | Checked — no match | The source completed, but none of its retained records matched this story. |
| WeLiveSecuritynews | ok empty0 records | Checked — no match | The source completed but returned no records in the collection scope. |
Additional verified pages 4 opened outside the registered collection
Vulnerability & exploitation2
Vendor & gov advisories1
Vendor advisory covering all four CVEs with full patch matrix for Xanadu, Yokohama, Zurich, and Australia releases
Analysis & research3
Independent technical breakdown identifying affected components: GraphQL Composite Data API, image upload processor, and dynamic schema ORDER BY clause
Corroborating coverage noting that exploitation of high-profile enterprise platform flaws typically begins within minutes of public disclosure
Confirms cloud tenants received automatic patches on 27 August 2026; self-hosted operators must apply manually