Security Advisory · August 2026 · ServiceNow
Three of four vulnerabilities disclosed by ServiceNow on August 27, 2026 carry a CVSS v4.0 score of 10.0 and reside in the AI Platform layer — the orchestration substrate that runs agentic AI workflows and RAG pipelines across ~100,000 enterprise applications serving roughly 85% of the Fortune 500.
Vulnerability Summary
| CVE | Type | CVSS v4.0 | Layer | Auth Required |
|---|---|---|---|---|
| CVE-2026-18885 | Code Injection → Remote Code Execution | 10.0 (Critical) | AI Platform | None |
| CVE-2026-18886 | Access Control Bypass → Privilege Escalation | 10.0 (Critical) | AI Platform | None |
| CVE-2026-74820 | SQL Injection | 10.0 (Critical) | AI Platform | None |
| CVE-2026-6876 | Sandbox Escape → Remote Code Execution | High | Now Platform (core) | Basic / low privilege |
Unauthenticated Code Injection / Remote Code Execution
An attacker who reaches the ServiceNow AI Platform over the network can inject code and run arbitrary commands on the instance. Successful exploitation lets the attacker read or modify data beyond what they are authorized to access. CVSS v4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Access Control Bypass / Privilege Escalation
This flaw lets an unauthenticated actor create or modify data in ways the system does not intend, resulting in privilege escalation that enables triggering workflow execution the attacker should not be allowed to run.
SQL Injection Against AI Platform Operational State
An attacker can execute arbitrary SQL statements against the database storing AI Platform operational state — including cached agent authentication tokens, RAG knowledge base content, and conversation histories. Stolen data gives attackers the pieces needed to pivot into connected enterprise systems or impersonate AI agents.
Sandbox Escape in Core Now Platform (Not an AI Platform Flaw)
A sandbox escape in the core Now Platform, rated High rather than Critical. Lets a low-privileged authenticated user break out of the execution sandbox. Architecturally separate from the three AI Platform flaws above.
Analysis
Code injection, access control bypass, and SQL injection are common vulnerability types. What makes this disclosure unusual is where they sit in the stack. All three critical flaws live in the platform layer that AI agents run on top of — not in the agents' own logic or prompts. This creates an amplification effect:
Agents already have broad permissions
ServiceNow AI agents need wide tool access to be useful. They can trigger enterprise workflows, read and write CRM and ITSM records, and query external data sources. An attacker who compromises the platform layer inherits the full permission set granted to every agent. No reverse-engineering or prompt manipulation is needed.
The attacks bypass agent-level safeguards entirely
Traditional LLM-security concerns like prompt injection or jailbreaking require the attacker to manipulate the model's behavior. These flaws skip that layer by compromising the orchestration substrate underneath. System prompts, output filters, and tool allow-lists become irrelevant once the platform is breached.
Stolen tokens extend the blast radius
The SQL injection exposes cached agent authentication tokens. Attackers can replay those tokens against the external systems the agents were authorized to call, reaching beyond the ServiceNow instance itself.
Attackers can trigger real business actions
AI Platform agents commonly drive business-process automation such as ticket creation, approvals, and record updates. An attacker with CVE-2026-18886-level access can initiate those actions through the workflow paths agents already use.
Exploitability Assessment
| Factor | Assessment |
|---|---|
| Attack complexity | Low — only network reachability required; no special conditions, privileges, or user interaction |
| Impact dimensions | High across all dimensions (confidentiality, integrity, availability at both component and downstream levels) |
| In-the-wild exploitation | No confirmed exploitation of CVE-2026-18885, CVE-2026-18886, or CVE-2026-74820 |
| Weaponization history | Prior ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) were chained by threat actors for data exfiltration campaigns |
| CVE-2026-6875 status | Separate July 2026 disclosure — actively exploited in the wild |
Remediation
ServiceNow-hosted instances enrolled in the ServiceNow Patching Program received the fixes automatically. Self-hosted customers must apply updates manually. Affected release trains include Xanadu, Yokohama, and Zurich family patches/hotfixes (e.g., Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b, Zurich Patch 7b Hot Fix 3).
Confirm your instance version against ServiceNow's patched-version list in KB3152242.
If patching was delayed past the disclosure window, treat any cached agent authentication tokens as potentially compromised and rotate credentials.
Audit AI agent tool-permission scopes independently of this patch. The amplification risk described in Section 2 persists architecturally even after these CVEs are fixed, because it stems from how broadly agents are provisioned, not solely from these bugs.
Review workflow execution and database access logs for the period before patching to identify anomalous unauthenticated activity.
Sources
ServiceNow, August 2026 CVE Advisory Notification, KB3152242
ServiceNow / THREATINT, CVE-2026-18885 record
BleepingComputer, "ServiceNow warns of three max severity security vulnerabilities"
Techzine Global, "ServiceNow patches four vulnerabilities in the Now Platform and AI Platform"
GBHackers, "ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection"
RedLegg Security Bulletin, "Multiple Critical Vulnerabilities in ServiceNow AI Platform"
NHS England Digital, Cyber Alert CC-4839