ServiceNow has released patches for four security vulnerabilities in its Now Platform, three of which received a maximum severity score of 10.0 on the Common Vulnerability Scoring System. The flaws could have allowed an attacker with no valid account and no user interaction from a victim to run arbitrary code, tamper with data, or execute database commands on affected instances.
The platform is used by an estimated 85% of Fortune 500 companies to run internal workflows, IT service management, and customer support operations, according to ServiceNow’s own figures, which makes any unauthenticated, remotely exploitable flaw in it a significant concern for a large share of large enterprises.
ServiceNow disclosed the issues on August 27, 2026. The first, tracked as CVE-2026-18885, is a code injection vulnerability in the platform’s GraphQL Composite Data API that could let an attacker execute arbitrary code and read or modify data without logging in. The second, CVE-2026-18886, involves improper access control in the system configuration image upload processor, which could let an unauthenticated user create or alter instance data and escalate their privileges. The third, CVE-2026-74820, is a SQL injection flaw in how the platform builds dynamic schema ORDER BY clauses, which could let an attacker run arbitrary SQL statements directly against the underlying database. All three require no authentication and are considered low complexity to exploit, meaning they do not depend on unusual configurations or timing.
A fourth, lower severity flaw, CVE-2026-6876, rated 8.7, is a sandbox escape in the Now Platform that could also lead to code execution. It is related to an earlier issue, CVE-2026-6875, which the security firm Searchlight Cyber first disclosed in April 2026 along with a public proof-of-concept exploit.
ServiceNow said it has already applied updates to the instances it hosts directly. Customers running self-hosted or partner-hosted instances need to apply the fixes themselves. According to SecurityWeek, the available patches include Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b and Patch 13 Hot Fix 4, Zurich Patches 7b through 12, and Australia Patches 2 through 5, depending on which release a given organization runs.
The company said it is “not currently aware of malicious exploitation against ServiceNow instances” tied to these four flaws, but urged customers to “promptly apply appropriate updates or upgrade to a patched release.” No CVE in this batch has been confirmed as actively exploited as of publication.
That caveat matters because ServiceNow vulnerabilities have drawn fast attacker interest before. The platform saw active exploitation of separate flaws in 2024 and again in July 2026, and unauthenticated, maximum-severity bugs in widely deployed enterprise software tend to attract scanning and exploitation attempts within days of technical details becoming public. Organizations running ServiceNow, particularly self-hosted or partner-hosted instances, should treat patching as urgent rather than routine.
Source: The Hacker News, with additional details from BleepingComputer.
