CVE-2026-74820

Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

No known exploitation. EPSS puts it in the 34th percentile. No fix published yet.

CVSS —Not scored EPSS percentile34th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-08-27Updated 2026-09-01Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your ServiceNow AI Platform deployment is on one of the affected (unpatched) releases by verifying your exact patch level.
Upgrade to one of the fixed releases: Xanadu Patch 11 Hot Fix 7a.
If you are on the Yokohama line, upgrade to Yokohama Patch 12 Hot Fix 3b or Yokohama Patch 13 Hot Fix 4.
If you are on the Zurich line, upgrade to one of: Zurich Patch 7b Hot Fix 3, Zurich Patch 8 Hot Fix 5, Zurich Patch 9 Hot Fix 6, Zurich Patch 10 Hot Fix 2m (m-branch), Zurich Patch 10 Hot Fix 3 (standard), Zurich Patch 11, Zurich Patch 12.
If you are on the Australia line, upgrade to Australia Patch 2 Hot Fix 3 or Australia Patch 3 Hot Fix 2.
After updating, confirm the instance reports the new patch/hot-fix level and keep the updated version documented for audit purposes.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

In plain language

Written by AI from the record

CVE-2026-74820 is a database injection flaw in ServiceNow AI Platform that can let an attacker run harmful database queries, and small businesses should act now by installing the listed hot fixes.

CVE-2026-74820 is an unauthenticated SQL injection in ServiceNow AI Platform via a dynamic SQL ORDER BY schema path (CWE-89), where crafted inputs can influence database query structure to read or change instance data; ServiceNow has provided fixed releases and there is no public exploit code on record.

If you're affected

Unauthorized access to instance data
Data modification or corruption
Service disruption from database changes
Business records and customer data exposure

What is it

Imagine a website page that builds a database request based on input parameters. This flaw can let an attacker manipulate that built request so the database interprets it differently than intended—like slipping a new instruction into the “search and sort” instructions. The result can be unauthorized reading or changing of data stored in your ServiceNow instance.

Who is affected

This matters if you use or host ServiceNow AI Platform and have not applied the hot fixes from ServiceNow. The weakness is described as unauthenticated, which means it can be triggered without a legitimate user account in certain circumstances. This is primarily a risk when the vulnerable feature/endpoint is reachable from where the attacker can send requests to your instance (commonly from the internet or any exposed network path).

How urgent is it

This vulnerability is being actively discussed enough to drive patching attention, and ServiceNow has released specific hot fixes because it can allow attackers to run SQL against the database. Even though no public exploit code is on record and KEV is not listed, the fixed availability is clear—so you should treat this as urgent to reduce the window of exposure.

What to do — in detail

Confirm exposure (version check)

Identify the exact ServiceNow AI Platform patch level and which branch you’re on (Xanadu, Yokohama, Zurich, or Australia).
Compare your current patch/hot-fix level to the fixed versions listed by ServiceNow below.

Apply the correct fixed release

Upgrade to the first matching fixed option for your branch:

Xanadu: fixed in Xanadu Patch 11 Hot Fix 7a
Yokohama: fixed in Yokohama Patch 12 Hot Fix 3b; or Yokohama Patch 13 Hot Fix 4
Zurich: fixed in Zurich Patch 7b Hot Fix 3; or Zurich Patch 8 Hot Fix 5; or Zurich Patch 9 Hot Fix 6; or Zurich Patch 10 Hot Fix 2m (m-branch); or Zurich Patch 10 Hot Fix 3 (standard); or Zurich Patch 11; or Zurich Patch 12
Australia: fixed in Australia Patch 2 Hot Fix 3; or Australia Patch 3 Hot Fix 2

If you can’t upgrade immediately (temporary containment)

Reduce exposure: ensure your ServiceNow instance is not reachable from unnecessary networks; keep firewall rules and network access restricted to required clients.
Review access paths: confirm which endpoints are exposed to the internet (if any) versus internal-only access.
Turn this into a tracked change: schedule patching as a priority item for the earliest maintenance window, because the fix depends on the hot-fix/patch versions above.

After patching

Verify the instance’s reported version now matches one of the fixed hot-fix versions.
Monitor for unusual database- or application-level errors and authentication/request anomalies around the time of the upgrade (not because exploitation is confirmed here, but to ensure stability and that the change took effect).

KEV / exploitation status

This CVE is not listed in CISA KEV based on the provided findings.
No public exploit code is on record based on the provided findings.

Timetable guidance

Since ServiceNow has released specific hot fixes and the verdict for this item is RED, plan to complete the upgrade urgently rather than deferring to later patch cycles.

Technical context

CVE-2026-74820 (CWE-89) is a SQL injection issue described as unauthenticated and involving a dynamic schema ORDER BY clause. In practical terms, the vulnerability allows an attacker’s input to influence how the SQL query is constructed, which can enable execution of unintended SQL against the underlying database—leading to potential data exposure or modification.

Exploitation/coverage signals from findings: no public exploit code is on record; CISA KEV is not listed; EPSS is a low predicted likelihood and flat trend (do not treat as a mitigation—this is only a prediction). Patching is available, with ServiceNow providing specific hot fixes across multiple release branches (Xanadu, Yokohama, Zurich, Australia). Because ServiceNow has already remediated and published fixed versions, the primary security action is upgrading to one of the listed hot fixes.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.