ServiceNow Patches Three Critical AI Platform Vulnerabilities
Summary
ServiceNow patched three critical AI Platform flaws exploitable without authentication or user interaction, plus a high-severity sandbox escape. It urged customers with self-hosted instances to update; the company reported no known malicious exploitation.
Key points
- The three critical vulnerabilities are CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820; all can be exploited without authentication or user interaction.
- The flaws could enable arbitrary code execution, privilege escalation, and access to or modification of instance data through SQL injection.
- ServiceNow also patched CVE-2026-6876, a high-severity sandbox escape that could allow attackers with basic privileges to achieve remote code execution.
- ServiceNow patched its cloud platform and advised customers with self-hosted instances to apply updates or upgrade to a patched release promptly.
- The company said it was not aware of malicious exploitation of these vulnerabilities.
Article Details
- Vulnerability Types
- Code injection
- SQL injection
- Privilege escalation
- Sandbox escape
- Severity
- Three maximum-severity vulnerabilities and one high-severity vulnerability
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For self-hosted instances, promptly apply the appropriate updates or upgrade to a patched release.
MITRE ATT&CK
CVE
CVE-2024-4879Servicenow · ServicenowTwo years ago, threat actors chained three ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) using publicly available exploits to breach private firms and government agencies worldwide in data theftCVE-2024-5178Vendor / Product unavailableTwo years ago, threat actors chained three ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) using publicly available exploits to breach private firms and government agencies worldwide in data theftCVE-2024-5217Servicenow · ServicenowTwo years ago, threat actors chained three ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) using publicly available exploits to breach private firms and government agencies worldwide in data theftCVE-2026-18885Vendor / Product unavailable#ServiceNowCVE-2026-18886Vendor / Product unavailable#ServiceNowCVE-2026-6875ServiceNow · ServiceNow AI PlatformMore recently, in July, threat intelligence company Defused reported that attackers are now exploiting another critical vulnerability (CVE-2026-6875), a pre-auth sandbox escape in the ServiceNow AI Platform.CVE-2026-6876Vendor / Product unavailable#ServiceNowCVE-2026-74820Vendor / Product unavailable#ServiceNow