ServiceNow Patches Four Vulnerabilities, Including Three Critical Flaws
Summary
ServiceNow patched four vulnerabilities: three critical flaws and a high-severity sandbox escape. Hosted instances are patched; self-hosted customers should apply hotfixes for the affected releases.
Key points
- The three critical flaws are CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820; the company says they can be exploited without authentication or user interaction and with low complexity.
- CVE-2026-18885 permits arbitrary code execution under certain circumstances; CVE-2026-18886 could enable arbitrary data changes and privilege escalation.
- CVE-2026-74820 is an SQL injection flaw that could allow arbitrary SQL statements against the ServiceNow database and access to or modification of instance data.
- CVE-2026-6876 is a high-severity sandbox escape that could enable unauthenticated code execution within the Now Platform.
- ServiceNow says hosted instances have been patched and released hotfixes for self-hosted Xanadu, Yokohama, Zurich, and Australia releases.
- iCOUNTER's Jason Brown urged self-hosted customers to prioritize applying and confirming the hotfixes, warning that patch delays can leave systems exposed.
Article Details
- Vulnerability Types
- Code injection
- Improper access control
- SQL injection
- Sandbox escape
- Severity
- Three vulnerabilities are critical (CVSS 10/10); the sandbox escape vulnerability is high severity (CVSS 8.7).
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-18885Vendor / Product unavailableThe first of the critical bugs, tracked as CVE-2026-18885, allows an attacker to execute arbitrary code in the ServiceNow platform under certain circumstances.CVE-2026-18886Vendor / Product unavailableThe second critical defect, CVE-2026-18886, is described as an improper access control issue.CVE-2026-6876Vendor / Product unavailableThe fourth issue, tracked as CVE-2026-6876 (CVSS score of 8.7), is a high-severity sandbox escape weakness that could be exploited without authentication for code execution within the Now Platform.CVE-2026-74820Vendor / Product unavailableTracked as CVE-2026-74820, the third critical vulnerability is an SQL injection flaw that allows an attacker to execute arbitrary SQL statements against the underlying ServiceNow database.
People
Vendors
Products
Now PlatformThe fourth issue, tracked as CVE-2026-6876 (CVSS score of 8.7), is a high-severity sandbox escape weakness that could be exploited without authentication for code execution within the Now Platform.ServiceNow AI PlatformServiceNow has announced patches for four vulnerabilities, including three critical code injection flaws in the ServiceNow AI platform, each with a maximum severity (CVSS score of 10/10).