IT Consultancy
IT Consultancy Get expert guidance to leverage technology for your business growth. We help you identify the right IT solutions, optimize infrastructure, and ensure your digital environment is secure,…
ServiceNow Patches Three Critical Flaws With CVSS 10.0 Scores
Digital Marketing
Digital Marketing Grow your brand and reach the right audience with data-driven marketing strategies. We help you create campaigns that convert, manage social channels effectively, and optimize your d…
Privacy Policy
Privacy Policy At CometSoul, accessible from https://cometsoul.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collec…
Terms and Conditions
Welcome to CometSoul! These terms and conditions outline the rules and regulations for the use of CometSoul’s Website, located at https://cometsoul.com. By accessing this website we assume you a…
Disclaimer
If you require any more information or have any questions about our site’s disclaimer, please feel free to contact us. Disclaimers for CometSoul All the information on this website – https…
Managed Wi-Fi Service
Managed Wi-Fi Service Build a fast, stable, and secure Wi-Fi for your business at Zero depreciation cost. Enterprise-Grade Guest Wi-Fi With $0 Upfront Hardware Costs. We provide, install, and support …
Smart Business System Integrator
Smart Business System Integrator Simplify your daily operations with smart systems that automate bookings, schedules, and routine tasks so you can focus on growing your business. We set up and integra…
IT Procurement & Hardware Managed Service
IT Procurement & Hardware Managed Service Keep your technology running smoothly from the hardware you use every day to the systems that power your business. We provide end-to-end IT management so …
ServiceNow has released patches for four security flaws in the ServiceNow AI Platform. Three of them have the maximum CVSS score of 10.0.
The issues are serious because an unauthenticated attacker may exploit them under certain conditions. As a result, attackers could run code, change data, or execute SQL commands.
Three CVSS 10.0 ServiceNow Flaws
CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API. If exploited, an attacker may run arbitrary code and access or modify instance data.
Meanwhile, CVE-2026-18886 affects access control in the system configuration image upload process. The flaw could lead to privilege escalation.
The third critical issue is CVE-2026-74820. This SQL injection flaw could allow an attacker to execute SQL commands against the ServiceNow database.
In addition, ServiceNow fixed CVE-2026-6876. This sandbox escape flaw has a CVSS score of 8.7.
Why Is the Risk High?
The three critical flaws can be reached over a network. In addition, they require no user privileges or user interaction.
Therefore, exposed vulnerable instances could face serious risk.
The possible impact includes data theft, unauthorized changes, and disruption to connected services.
Hosted and Self-Hosted Instances
ServiceNow has already deployed the security update to instances it hosts.
However, self-hosted customers must install the fixes themselves. Therefore, IT teams should check their ServiceNow versions as soon as possible.
Affected releases include certain versions of Xanadu, Yokohama, Zurich, and Australia before specific hotfix levels.
Have the Flaws Been Exploited?
At the time of disclosure, ServiceNow said it was not aware of active exploitation of the four new flaws.
In addition, no public exploit code was known for the three CVSS 10.0 issues.
Even so, unauthenticated vulnerabilities with maximum severity ratings should be treated as a high priority.
What Should Organizations Do?
Self-hosted customers should install the latest ServiceNow security updates immediately.
Also, review logs for unusual activity. Access to administrative interfaces and APIs should be limited to trusted users and networks.
For hosted instances, ServiceNow has already applied the fixes. However, security teams should continue monitoring suspicious logins and unexpected data changes.
Key Takeaway
Three ServiceNow AI Platform flaws received the maximum CVSS score of 10.0. They could lead to code execution, privilege escalation, and SQL injection.
Although there is no known active exploitation, the possible impact is serious. Therefore, self-hosted customers should patch quickly and restrict access to their ServiceNow instances.
Source: https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html