1.
Basic Information Article Title: ServiceNow Patches 3 Critical Code Injection Vulnerabilities Source: SecurityWeek Publication Date: 2026-08-31 Original Article: SecurityWeek Related Sources: ServiceNow August 2026 CVE Advisory, BleepingComputer Related Malware, Threat Groups, CVEs, Products: CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876, ServiceNow AI Platform, Now Platform Severity: Critical
2.
Executive Summary ServiceNow patched three unauthenticated CVSS 10.0 vulnerabilities—code injection in the GraphQL Composite Data API, an access control flaw in configuration image upload processing, and SQL injection in dynamic schema ORDER BY clauses—along with an unauthenticated sandbox escape in the ServiceNow AI Platform.
3.
Attack Flow From Unauthenticated Request to Instance Compromise An attacker sends a crafted request to an externally accessible ServiceNow AI Platform.
CVE-2026-18885 causes code injection in the GraphQL Composite Data API.
CVE-2026-18886 exploits an access control flaw in configuration image upload processing to create and modify data and escalate privileges.
CVE-2026-74820 injects SQL into dynamic ORDER BY clauses to manipulate the underlying database.
CVE-2026-6876 escapes the sandbox to execute code within the Now Platform.
Successful exploitation can spread to instance data, integration credentials, approval workflows, and external systems.
Active exploitation is not observed.
4.
Attacker Position and Execution Context An unauthenticated external attacker with network access to the HTTP(S) endpoint of the ServiceNow instance.
Operates with the privileges of the Now Platform or the underlying database upon successful exploitation.
5.
Visibility for Victims and Administrators Victims Because exploitation requires no user interaction, it may appear on the screen as unauthorized changes to data, settings, permissions, or approval workflows.
Administrators Clues include abnormal GraphQL requests, configuration image uploads, errors involving ORDER BY clauses, and data modifications or privilege escalations originating from unauthenticated sessions.
6.
Conditions for Success and Failure Conditions for Success Network reachability to the vulnerable ServiceNow environment.
The applicable hotfix is not installed.
WAF or API controls do not block the crafted requests.
Conditions for Failure / Risk Mitigation Apply the hotfix provided by ServiceNow and verify the patched version.
Restrict external exposure of administration, API, and upload functions to required sources only.
Enable auditing for GraphQL, file uploads, SQL errors, and permission changes.
7.
What Happens Upon Success Arbitrary code execution.
Reading, creation, and modification of instance data.
Privilege escalation and tampering with approval workflows.
Arbitrary SQL execution on the underlying database and impact on external integrations.
8.
Observable Logs Email: No emails are required to exploit these vulnerabilities.
Abnormal notification or approval emails after compromise can be useful.
Proxy/SWG/DNS: Low-frequency abnormal requests from external sources to ServiceNow API, GraphQL, or upload endpoints.
Endpoint/EDR: For self-hosted instances, check for suspicious child processes of ServiceNow, file creation, and script execution.
Identity/IdP: New high-privilege users, role assignments, sessions, or integration credential usage immediately following unauthenticated requests.
SaaS/Cloud: Execution history for GraphQL, image uploads, audits, data changes, role changes, and IntegrationHub.
Network: Outbound traffic from ServiceNow to unknown destinations or unusual integration endpoints.
9.
Attack Success Determination Attack Attempt Observed (Success Unconfirmed): Only reconnaissance or error requests to vulnerable endpoints are confirmed; no data modification or code execution is observed.
User Interaction Confirmed: Authentication and user interaction are not required.
Initial Execution Confirmed: Evidence of vulnerable proc