ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection

ServiceNow has issued security advisories for four vulnerabilities, including critical flaws in its AI platform. These vulnerabilities could allow unauthenticated attackers to execute arbitrary code, manipulate instance data, elevate privileges, or run SQL commands against underlying databases.

On August 27, 2026, the company published KB3152242, which covers CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820.

ServiceNow reported that it independently remediated each issue following findings from its internal security research and responsible disclosure program.

Although detailed technical exploitation information is limited, the advisory outlines potential attack paths that could grant access beyond intended authorization limits. Customers are urged to verify their version and ensure that all production instances have received the necessary updates.

ServiceNow Patches Critical Flaws

The most severe issues, CVE-2026-18885 and CVE-2026-18886, are rated as critical under the CVSS v4.0 calculator. Both are code-injection vulnerabilities affecting the ServiceNow AI platform.

CVE-2026-18885 may allow an unauthenticated attacker to execute arbitrary code on the ServiceNow platform in certain situations, potentially enabling access to or alteration of instance data outside intended controls.

Similarly, CVE-2026-18886 could allow unauthorized creation or modification of instance data, potentially leading to privilege escalation.

This distinction is important: one scenario presents a direct code-execution risk, while the other focuses on unauthorized data operations that could increase an attacker’s effective permissions. Both require swift remediation and a careful review of platform access logs.

CVE-2026-74820 is also rated critical and addresses SQL injection vulnerabilities in the ServiceNow AI platform. ServiceNow warned that, under certain circumstances, an unauthenticated user could execute arbitrary SQL statements against an instance’s underlying database.

Successful exploitation could expose or modify data beyond intended access limits, creating significant risks for confidentiality, integrity, and business workflow operations.

In contrast, CVE-2026-6876 is rated high and concerns a sandbox escape within the Now Platform. This flaw could enable unauthenticated arbitrary code execution within the platform, resulting in greater access than intended. Sandbox escapes can be particularly harmful, as they undermine the isolation controls designed to contain untrusted execution.

ServiceNow indicated that customers enrolled in its Patching Program have received the necessary updates. However, organizations should still verify their instance versions.

The remediated builds include Xanadu Patch 11 Hot Fix 7a; Yokohama Patch 12 Hot Fix 3b and Patch 13 Hot Fix 4; multiple Zurich releases through Patch 12; and Australia patches 2 through 5.

Administrators should compare their deployed versions against the advisory, apply the relevant patch or hotfix, and assess exposure from internet-accessible AI functions.

Additionally, security teams should examine authentication logs, database activity, any unusual changes to instance records, and privileged actions for signs of attempted exploitation. Prompt patching is essential to maintain security.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC