CVE Tools
Track your stack

ServiceNow warns of three max severity security vulnerabilities

BleepingComputerBy Sergiu Gatlan

PatchServiceNow AI Platform

Our summary

ServiceNow has issued security updates for three maximum-severity vulnerabilities affecting its AI Platform, addressing weaknesses that enable code injection, SQL injection, and privilege escalation. These defects (CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820) are exploitable by unauthenticated attackers without user interaction, posing significant risks to enterprise environments relying on the platform. While no active exploitation has been confirmed for these specific issues, the company urges immediate patch application for self-hosted instances.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker NewsThree CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQLCVE-2026-18885, CVE-2026-18886 +3
  2. SecurityWeekServiceNow Patches 3 Critical Code Injection VulnerabilitiesCVE-2026-18885, CVE-2026-18886 +2
  3. The Hacker News⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and MoreCVE-2026-18885, CVE-2026-18886 +1
  4. Check Point Research31th August – Threat Intelligence ReportCVE-2026-18885, CVE-2026-18886 +1
  5. Help Net SecurityWeek in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breachedCVE-2026-6875
  6. SecurityWeekExploitation of ServiceNow Vulnerability Seen Days After DisclosureCVE-2026-6875
  7. The Hacker NewsCritical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code ExecutionCVE-2026-6875
  8. Help Net SecurityServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)CVE-2026-6875
  9. The Hacker News⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and MoreCVE-2026-6875
  10. BleepingComputerCritical ServiceNow code execution flaw now exploited in attacksCVE-2026-6875

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store