CVE-2026-18885

This vulnerability could allow someone on the internet—without an account—to trick ServiceNow into running attacker-supplied code. If that happens, the attacker could read or change your ServiceNow instance data, like a malicious “switch” that lets them take control of parts of the system they shouldn’t reach. The fix is available in specific patch releases.

This matters if your business uses or hosts the ServiceNow AI Platform and your environment is exposed in a way that lets an external attacker reach the vulnerable GraphQL Composite Data API. It’s not just “any ServiceNow customer” by default—the risk depends on whether the vulnerable functionality is reachable from outside and the conditions described by the vendor. Only proceed as urgent if your ServiceNow AI Platform is at a pre-fix version and the relevant endpoint is reachable.

Treat this as urgent because it’s unauthenticated and can lead to remote code execution, which can quickly escalate into full compromise of your ServiceNow instance. Even though there’s no public exploit code on record and no KEV listing, ServiceNow has already issued a patch due to the severity of the risk; act to move to a fixed release now.

1. Confirm exposure basics:

   • Identify whether your ServiceNow AI Platform is publicly reachable or otherwise reachable from the internet (directly or via a gateway/WAF) for the GraphQL Composite Data API.
   • Confirm whether the relevant AI Platform capability using the GraphQL Composite Data API is enabled.

2. Identify your exact software level:

   • Check the ServiceNow AI Platform version/patch level currently installed in your instance.
   • Compare it to the vendor’s fixed releases listed below.

3. Upgrade to a fixed release (choose the fixed version that matches your branch):

   • Xanadu Patch 11 Hot Fix 7a
   • Yokohama Patch 12 Hot Fix 3b
   • Yokohama Patch 13 Hot Fix 4
   • Zurich Patch 7b Hot Fix 3
   • Zurich Patch 8 Hot Fix 5
   • Zurich Patch 9 Hot Fix 6
   • Zurich Patch 10 Hot Fix 2m (m-branch)
   • Zurich Patch 10 Hot Fix 3 (standard)
   • Zurich Patch 11
   • Zurich Patch 12
   • Australia Patch 2 Hot Fix 3
   • Australia Patch 3 Hot Fix 2

4. If you cannot patch immediately:

   • Reduce reachability: limit external access so the affected GraphQL endpoint is not reachable from the internet.
   • Apply compensating controls your environment supports (for example, restricting inbound routes to the minimum set and enforcing network allowlists).
   • Treat this as temporary—patching remains the fix.

5. What to monitor after the upgrade:

   • Monitor for unusual access attempts to GraphQL-related endpoints.
   • Review logs around GraphQL requests for abnormal patterns (especially requests that you would not expect).

Note on exploitation status: ServiceNow states it is not currently aware of malicious exploitation against ServiceNow instances, and there is no public exploit code on record; nevertheless, the vendor-issued patches should be applied promptly.

Severity is high because this is Remote Code Execution (CWE-94) with no authentication requirement described in the issue: an unauthenticated attacker may be able to execute arbitrary code via crafted input in the GraphQL Composite Data API, potentially leading to access or modification of instance data. The vendor indicates the update has been deployed for hosted instances and provided to partners for self-hosted customers. No KEV entry was found, and there is no public exploit code recorded; EPSS is a prediction only and is not confirmation of real-world exploitation. Patch availability is well-defined across multiple release branches, starting with Xanadu Patch 11 Hot Fix 7a and corresponding fixed hot fixes for Yokohama/Zurich/Australia.