ServiceNow Patched Three CVSS 10 Flaws. No Login Was Required.
ServiceNow’s August advisory is larger than the GraphQL flaw first disclosed. It contains three maximum-severity vulnerabilities that can be exploited without credentials, plus a high-severity sandbox escape. Hosted instances have been remediated, but self-hosted customers need to verify the full patch level.
The original BlackTree article covered CVE-2026-18885, an unauthenticated GraphQL code-injection vulnerability. ServiceNow’s completed bulletin also includes CVE-2026-18886, an unauthenticated privilege-escalation flaw in a system-configuration image upload processor, and CVE-2026-74820, an unauthenticated SQL-injection flaw.
ServiceNow scores all three at 10.0 under CVSS 4.0. A fourth vulnerability, CVE-2026-6876, is an 8.7 sandbox escape that can also lead to arbitrary code execution. ServiceNow says it is not aware of malicious exploitation against customer instances.
Three different paths cross the same trust boundary
| Vulnerability | Impact and prerequisites | Exploitation and PoC status |
|---|---|---|
| CVE-2026-18885 Critical, 10.0 | Remote, low-complexity code injection in the GraphQL Composite Data API. No authentication or user interaction is required. | ServiceNow reports no known malicious exploitation. No public PoC was identified. |
| CVE-2026-18886 Critical, 10.0 | Improper access control in the system-configuration image upload processor can let an unauthenticated attacker create or modify instance data and escalate privileges. | ServiceNow reports no known malicious exploitation. No public PoC was identified. |
| CVE-2026-74820 Critical, 10.0 | Unauthenticated SQL injection in a dynamically constructed schema ORDER BY path can allow arbitrary SQL against the instance database. | ServiceNow reports no known malicious exploitation. No public PoC was identified. |
| CVE-2026-6876 High, 8.7 | Sandbox escape that can lead to arbitrary code execution and access beyond the intended platform boundary. The CVSS 4.0 vector lists low privileges required, while the vendor description says an unauthenticated user may exploit it in some circumstances. | ServiceNow reports no known malicious exploitation. No public PoC was identified. |
The distinction between the flaws matters. The GraphQL issue reaches code execution through an API. The image-upload issue reaches privileged data modification through broken access control. The SQL-injection issue reaches the underlying database query layer. A single compensating control may not cover all three paths.
Why the platform’s role increases the impact
A ServiceNow instance often sits close to employee identity, IT operations, customer-service records, asset inventories and automation that can trigger actions in other systems. Code execution, database access or unauthorised configuration changes at that trust boundary can expose both platform data and connected services.
The 10.0 ratings are therefore not merely a mathematical consequence of an exposed endpoint. They describe remote attacks requiring no credentials, no user interaction and low complexity, with high impact to confidentiality, integrity and availability of both the vulnerable system and connected systems.
Hosted instances are fixed, self-hosted deployments need verification
ServiceNow says it deployed the security update to hosted instances. Partners and self-hosted customers received the update but must verify that every environment is at or above a fixed build.
- Xanadu: Patch 11 Hot Fix 7a or later
- Yokohama: Patch 12 Hot Fix 3b, Patch 13 Hot Fix 4 or later
- Zurich: Patch 7b Hot Fix 3, Patch 8 Hot Fix 5, Patch 9 Hot Fix 6, Patch 10 Hot Fix 2m for the m-branch, Patch 10 Hot Fix 3 for the standard branch, Patch 11, Patch 12 or later
- Australia: Patch 2 Hot Fix 3, Patch 3 Hot Fix 2, Patch 3m, Patch 4, Patch 5 or later
The record for CVE-2026-18886 marks one Australia range differently from the other three records. Administrators should use ServiceNow KB3152242 and the complete build identifier as the controlling remediation guidance rather than relying on a family name alone.
What defenders should do now
- Inventory every instance. Include development, test, disaster-recovery, cloned and partner-managed environments.
- Verify the exact build. Compare the full patch and hot-fix designation with KB3152242 for the relevant release branch.
- Review unauthenticated activity. Hunt for unusual GraphQL requests, image-upload or configuration changes, schema and sort manipulation, and unexpected database-backed record changes.
- Inspect privileged changes. Review new users, role assignments, integrations, credentials, scripts and outbound connections from the platform.
- Protect connected systems. Rotate integration secrets and validate downstream automation if compromise is suspected.
The BlackTree view
The completed bulletin changes the story. This is not one GraphQL bug. It is a cluster of unauthenticated paths that reach code, data and administrative state across a platform trusted to coordinate business operations.
No active exploitation is confirmed, and no public exploit was identified. Those evidentiary limits should remain explicit. So should the operational conclusion: three remote, no-login, maximum-severity flaws in one widely connected platform deserve immediate verification and patching.
Sources
- ServiceNow security advisory KB3152242, published 27 August 2026. The vendor did not provide a publication time.
- Official CVE record for CVE-2026-18885, published 27 August 2026 at 18:54 UTC.
- Official CVE record for CVE-2026-18886, published 27 August 2026.
- Official CVE record for CVE-2026-74820, published 27 August 2026.
- Official CVE record for CVE-2026-6876, published 27 August 2026.
- The Hacker News: Three CVSS 10.0 ServiceNow flaws, published 28 August 2026. The page did not expose a publication time.
