ServiceNow

ServiceNow AI Platform Affected by Five Vulnerabilities Including Critical SQL Injection Flaws

ServiceNow disclosed five vulnerabilities in its AI Platform on September 24, 2026, through a security advisory. Two of the issues received CVSS v4.0 base scores of 9.3 and were rated Critical. CVE-2026-13016 allows unauthenticated remote attackers to perform SQL injection and manipulate database contents under specific conditions. CVE-2026-86860 stems from improper authorization checks that enable data exfiltration and privilege escalation without authentication. The flaws were identified via internal testing, coordinated disclosure, and the company's bug bounty program. ServiceNow urges customers to apply the provided updates immediately to mitigate the risks.

ServiceNow Discloses Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Remote Code Execution and SQL Injection

ServiceNow has released security updates addressing four vulnerabilities in its AI platform, including three rated CVSS 10.0. The flaws enable unauthenticated attackers to achieve remote code execution, privilege escalation, and arbitrary SQL execution against core ITSM systems used by large enterprises worldwide. Affected components include the GraphQL Composite Data API, system configuration image upload processor, and dynamic schema ORDER BY handling. ServiceNow states it has patched hosted instances and provided hotfixes for self-hosted customers running Xanadu, Yokohama, Zurich, and Australia branches. This follows a July disclosure of a related sandbox escape tracked as CVE-2026-6875 that showed signs of in-the-wild exploitation. No public exploits or confirmed active attacks have been observed for the new issues yet, but the extremely low attack complexity leaves a narrow remediation window for organizations running exposed instances.

ServiceNow Patches Multiple Critical Vulnerabilities in Now Platform and AI Platform

ServiceNow disclosed several critical vulnerabilities affecting the Now Platform and ServiceNow AI Platform on August 27. The issues include unauthenticated code injection via the GraphQL Composite Data API, improper access controls during system image uploads, and SQL injection flaws that allow arbitrary database queries. Four CVEs were published: CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. Exploitation of CVE-2026-18885 could permit remote code execution and data manipulation without authentication under certain conditions. CVE-2026-18886 enables unauthorized data creation, modification, and privilege escalation, while CVE-2026-74820 allows direct SQL execution against the underlying database. ServiceNow has released updated versions to address the flaws.