ServiceNow Warns of Three Critical CVE-2026 Flaws With Maximum CVSS Severity

ServiceNow Discloses Three Critical Vulnerabilities Affecting Its AI Platform

ServiceNow has disclosed three critical security vulnerabilities affecting its AI Platform, prompting organisations to review their ServiceNow environments and apply the relevant security updates.

The vulnerabilities are tracked as CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820. The flaws involve code injection, improper access control and SQL injection respectively.

All three vulnerabilities have been assigned a CVSS 4.0 score of 10.0, placing them at the highest level of severity under the CVSS scoring system.

ServiceNow published the disclosure in its August 2026 CVE Advisory Notification, identified as KB3152242.

Three Critical Vulnerabilities

The advisory covers three separate security issues.

CVE-2026-18885: Code Injection

The first vulnerability is a code injection flaw.

According to the available vulnerability information, exploitation could allow an unauthenticated attacker to execute arbitrary code and potentially access or modify ServiceNow instance data.

The vulnerability is particularly significant because it does not require an attacker to already have privileges within the affected environment.

CVE-2026-18886: Improper Access Control

The second issue, CVE-2026-18886, involves improper access control.

The vulnerability could allow an unauthenticated attacker to create or modify instance data and potentially escalate privileges.

For organisations using ServiceNow to manage business workflows, IT operations and enterprise information, weaknesses in access control can create serious risks because they can undermine the boundaries between authorised and unauthorised actions.

CVE-2026-74820: SQL Injection

The third vulnerability is a SQL injection flaw.

According to the published vulnerability information, an unauthenticated attacker could potentially execute arbitrary SQL statements and access or modify underlying instance data.

SQL injection remains a significant application security risk because it can allow attackers to interact with backend data through vulnerable application functionality.

Why the Three Flaws Matter

The severity of the disclosure comes from the combination of several factors.

The vulnerabilities are remotely exploitable and the published CVSS information indicates that exploitation does not require existing privileges or user interaction.

In practical terms, this means organisations should not treat the issues as vulnerabilities that can simply wait for a routine maintenance cycle.

The affected platform can contain sensitive enterprise information and support important business workflows. Any vulnerability that could enable unauthorised code execution, data manipulation or access-control bypass therefore deserves immediate attention.

ServiceNow's Response

ServiceNow has issued security updates for the affected vulnerabilities.

The company stated that security updates were deployed to its hosted instances and made available to partners and self-hosted customers.

ServiceNow also stated that it was not aware of malicious exploitation of ServiceNow instances associated with these vulnerabilities at the time of the advisory.

That distinction is important. The disclosure establishes the existence and severity of the vulnerabilities, but it does not establish that attackers have actively exploited them.

Additional details were not disclosed in the announcement.

What Organisations Should Do

Organisations operating ServiceNow environments should first determine which ServiceNow release and patch level they are running.

Security teams should then compare their environment against the affected and fixed versions identified in the official advisory.

The recommended response is straightforward:

• Identify affected ServiceNow instances.

• Check the current release and patch level.

• Review KB3152242 for the applicable remediation.

• Apply the relevant security update or upgrade.

• Review security logs and monitoring data for unusual activity.

• Continue monitoring for further guidance from ServiceNow.

Organisations should use the official ServiceNow advisory as the authoritative source for determining the correct update for their specific deployment.

Affected ServiceNow Releases

The published vulnerability information identifies multiple affected ServiceNow release branches and patch levels.

These include versions across Xanadu, Yokohama, Zurich and Australia release families.

Because ServiceNow environments can differ by release and patch level, organisations should not assume that being on a particular major release automatically means they are protected.

The appropriate remediation depends on the precise version and patch level installed.

The company did not provide specific information about this area beyond the release and remediation details in its advisory.

What This Means for Security Teams

The disclosure highlights a broader industry shift toward treating enterprise workflow platforms as critical security infrastructure.

ServiceNow environments can sit at the centre of IT operations and business processes. As a result, vulnerabilities affecting application logic, access controls or backend data handling can have implications beyond a single application component.

For enterprises, this could mean vulnerability management teams need to consider workflow and enterprise-service platforms alongside traditional infrastructure, endpoint and cloud security assets.

The incident also reinforces the importance of maintaining an accurate software inventory. Security teams cannot reliably determine exposure without knowing which releases and patch levels are deployed.

No Confirmed Exploitation Reported

One of the most important points for organisations is the distinction between critical vulnerability severity and confirmed exploitation.

ServiceNow's available advisory information indicates that the company was not aware of malicious exploitation of its instances related to these vulnerabilities.

That does not reduce the importance of remediation.

A vulnerability can represent a significant security risk even when there is no confirmed evidence of exploitation. Organisations should therefore focus on determining exposure and applying the appropriate fixes rather than waiting for evidence of an attack.

The Bigger Security Picture

The ServiceNow disclosure demonstrates how vulnerabilities in enterprise platforms can combine different classes of application security weaknesses.

Code injection can create risks around application execution. Access-control weaknesses can affect authorisation boundaries, while SQL injection can expose backend data-handling mechanisms.

The three vulnerabilities are technically different, but their presence in the same advisory creates a clear message for security teams: enterprise application security requires continuous patching, access-control review and monitoring.

For organisations with ServiceNow deployments, the immediate priority is to establish whether their environment is affected and follow the remediation instructions in the official ServiceNow advisory.

ServiceNow has not disclosed additional details beyond the information contained in its security notification.

Conclusion

ServiceNow's August 2026 CVE advisory covers three critical vulnerabilities affecting its AI Platform: CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820.

The vulnerabilities involve code injection, improper access control and SQL injection, with each receiving a CVSS 4.0 score of 10.0.

ServiceNow has issued security updates and advised customers to apply the applicable fixes. The company also stated that it was not aware of malicious exploitation of ServiceNow instances associated with the vulnerabilities.

For organisations running affected ServiceNow versions, the priority should be clear: identify exposure, apply the relevant security update and continue monitoring the environment.