ServiceNow is the workflow backbone for a large share of the Fortune 500. When a single unauthenticated request can reach code execution or the instance database, the blast radius is not a help-desk ticket — it is HR records, identity workflows, CMDB assets, and the integrations that sit behind them.
On 27 August 2026, ServiceNow published advisory KB3152242 and assigned four new CVEs. Three of them are scored CVSS 4.0 10.0. All three are network-reachable, require no privileges and no user interaction, and carry high impact on confidentiality, integrity, and availability — including subsequent systems. A fourth sandbox-escape issue landed at 8.7. Hosted instances were updated by ServiceNow. Self-hosted customers and partners must patch themselves.
This is the second major ServiceNow patch cycle of the summer. In July, CVE-2026-6875 (pre-auth sandbox escape, CVSS 9.5) was disclosed with a public technical write-up from Searchlight Cyber. Threat intel firm Defused later reported in-the-wild activity that ServiceNow said it has not tied to ServiceNow-hosted instances. That history is why these new 10.0 ratings should be treated as an operational priority, not a paperwork exercise.
Vulnerability type table
| CVE | Type | Component / sink | Auth | CVSS 4.0 | CWE (mapped) | Credit |
|---|---|---|---|---|---|---|
| CVE-2026-18885 | Code injection → unauth RCE | GraphQL Composite Data API | None | 10.0 | CWE-94 | Adam Kues, Assetnote |
| CVE-2026-18886 | Improper access control → privilege escalation | System Configuration image upload processor | None | 10.0 | CWE-284 | Kevin Gervot, Assetnote |
| CVE-2026-74820 | SQL injection | Dynamic schema ORDER BY clause | None | 10.0 | CWE-89 | — |
| CVE-2026-6876 | Sandbox escape | Now Platform script sandbox | Low privileges | 8.7 | CWE-693 / sandbox bypass | Paul Alkemade |
Shared vector for the three 10.0 issues:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVE-2026-6876 uses PR:L and scores subsequent-system impact as none:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
ServiceNow is the CNA. The scores above are the vendor's own CVSS 4.0 ratings. None of the four were in CISA's Known Exploited Vulnerabilities catalog as of 28 August 2026, and ServiceNow states it is not aware of malicious exploitation of these new issues. There is no public exploit code for the three 10.0 flaws at time of writing.
What each flaw actually does
CVE-2026-18885 — Unauthenticated RCE in the GraphQL Composite Data API. A code-injection bug in the ServiceNow AI Platform GraphQL composite data path. An unauthenticated caller who can reach the instance can, in certain circumstances, execute arbitrary code and read or modify instance data beyond intended access. This is the most operationally dangerous of the four: it is pre-auth, low complexity, and lands on code execution rather than a single table. Title and credit come from the published CVE record (Adam Kues / Assetnote).
CVE-2026-18886 — Unauthenticated privilege escalation via image upload. Improper access control in the System Configuration image upload processor. An unauthenticated user can create or modify instance data in a way that escalates privilege. In a ServiceNow context that usually means planting or altering configuration, attachments, or records that later run with a stronger security context. Credit: Kevin Gervot / Assetnote.
CVE-2026-74820 — Unauthenticated SQL injection via dynamic schema ORDER BY.
The sink is an ORDER BY clause built from a dynamic schema. Classic injection surface: sort parameters are often treated as "safe identifiers" and skip the same parameterization applied to WHERE values. Successful exploitation lets an unauthenticated user run arbitrary SQL against the instance database — data theft, data modification, and in some database configurations a path toward further execution.
CVE-2026-6876 — Sandbox escape on the Now Platform. Related family to the July issue, but not the same CVE. It can allow code execution inside the platform sandbox with low privileges (not a true unauthenticated 10.0). Treat it as part of the same hardening push ServiceNow started after CVE-2026-6875, including tighter sandbox rules such as Guarded Script. Credit: Paul Alkemade.
Vendor language on all four is the same on two points that matter for defenders: "in certain circumstances," and "we are not currently aware of malicious exploitation." "Certain circumstances" usually means a reachable feature, plugin, or API surface rather than every instance being trivially exploitable from the internet. That is not a reason to delay patching self-hosted systems.
Affected releases
| Family | Vulnerable until |
|---|---|
| Xanadu | Any version before Patch 11 Hot Fix 7a |
| Yokohama | Any version before Patch 12 Hot Fix 3b, and any version before Patch 13 Hot Fix 4 |
| Zurich | Any version before Patch 7b Hot Fix 3, Patch 8 Hot Fix 5, Patch 9 Hot Fix 6, Patch 10 Hot Fix 2m (m-branch), Patch 10 Hot Fix 3 (standard), Patch 11, or Patch 12 |
| Australia | Any version before Patch 2 Hot Fix 3, Patch 3 Hot Fix 2, Patch 3m, Patch 4, or Patch 5 |
Default product status for unnamed releases is unaffected. Confirm exact build IDs against KB3152242 and family release notes on docs.servicenow.com before you close the ticket. For CVE-2026-18886, Australia Patch 5 is listed with status unknown in some record views — do not assume that one hotfix covers every CVE in the bundle.
Why this cluster matters
ServiceNow instances are rarely "just ITSM." They hold ticket text with credentials, employee PII, vendor records, and workflow scripts. They also front MID servers and proxy connections into internal networks. Searchlight Cyber's July write-up on CVE-2026-6875 made that chain explicit: sandbox escape to table access to admin creation to commands on connected proxy hosts.
The August trio does not need that full chain. One bug is already RCE. One is already SQL against the backing database. One is already unauthenticated data/config modification that escalates privilege. Those are three independent ways to own the same class of system.
Assetnote researchers (Kues and Gervot) appearing on two of the 10.0 records is consistent with continued, high-quality offensive review of ServiceNow's API and upload surfaces after the mid-year sandbox work. Searchlight has not published a technical write-up for the August flaws. That reduces short-term copy-paste exploitation risk — it does not reduce the value of the bugs to anyone who can find the same sinks.
Exploitation status (as of 28 August 2026)
- CVE-2026-18885 / 18886 / 74820 / 6876: no public exploit code; vendor not aware of malicious exploitation.
- CVE-2026-6875 (prior): public PoC and research from Searchlight Cyber; Defused reported exploitation activity; ServiceNow said it has not seen that activity on instances it hosts. Not listed in CISA KEV at the time of the August advisory coverage.
Do not wait for a KEV listing. Self-hosted and delayed-upgrade environments are the realistic target set.
MITRE ATT&CK mapping
| Tactic | Technique ID | Technique | How it shows up here |
|---|---|---|---|
| Initial Access | T1190 | Exploit Public-Facing Application | Unauthenticated HTTP/GraphQL/SQL sinks on the instance |
| Execution | T1059 | Command and Scripting Interpreter | Code injection and sandbox escape inside platform script engines |
| Privilege Escalation | T1068 | Exploitation for Privilege Escalation | CVE-2026-18886 configuration/image processor |
| Collection | T1213 | Data from Information Repositories | SQLi and RCE against ITSM/HR/CMDB tables |
| Impact | T1565 | Data Manipulation | Unauth create/modify of instance data |
| Lateral Movement | T1210 | Exploitation of Remote Services | Historic pattern: platform code exec → MID/proxy hosts |
Defensive recommendations
- Patch self-hosted first. Hosted customers should verify ServiceNow actually applied KB3152242 to every instance (prod, sub-prod, developer, and forgotten sidecar). Self-hosted and partner-managed instances are on you.
- Upgrade the family, do not cherry-pick one hotfix. The July and August advisories land on overlapping release trains. A box patched for CVE-2026-6875 is not automatically patched for the August 10.0 set.
- Inventory internet exposure. GraphQL endpoints, unauthenticated assessment/scripted REST resources, and file-upload/processors should not be on the public internet unless there is a documented business need and WAF controls.
- Hunt, then patch — but do not delay the patch. Look for anomalous unauthenticated GraphQL traffic, unexpected
ORDER BY/ sort-parameter abuse, image or system-property writes from unauthenticated sessions, new admin/user records, and new script includes or scheduled jobs created outside change windows. - Assume table-level compromise if you were unpatched and exposed. Rotate integration credentials stored in the instance, review MID server and proxy logs, and treat connected internal systems as adjacent risk — the pattern established by CVE-2026-6875 research.
- Track CISA KEV, but treat vendor 10.0 + pre-auth + enterprise SaaS/PaaS as already actionable.
Sources
- The Hacker News, Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL (28 Aug 2026): https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html
- ServiceNow advisory KB3152242: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
- ServiceNow CVE advisory index KB1226057: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1226057
- CVE-2026-18885: https://www.cve.org/CVERecord?id=CVE-2026-18885
- CVE-2026-18886: https://www.cve.org/CVERecord?id=CVE-2026-18886
- CVE-2026-74820: https://www.cve.org/CVERecord?id=CVE-2026-74820
- CVE-2026-6876: https://www.cve.org/CVERecord?id=CVE-2026-6876
- Prior issue CVE-2026-6875: https://www.cve.org/CVERecord?id=CVE-2026-6875
- Searchlight Cyber, Smashing the ServiceNow Sandbox – Pre Authentication RCE (CVE-2026-6875): https://www.slcyber.io/research/smashing-the-servicenow-sandbox-pre-authentication-rce
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog