ServiceNow AI Platform CVE-2026-18885: Three CVSS 10.0 Flaws Enable Unauthenticated RCE and SQL Injection

All three maximum-severity flaws share the same CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:N with full impact to confidentiality, integrity, and availability in both the vulnerable component and connected systems. The "subsequent system" scope rating is critical: successful exploitation puts not just the ServiceNow instance at risk but every downstream system it integrates with.

CVE-2026-18885 targets the GraphQL Composite Data API, a unified query interface that ServiceNow exposes to allow external systems to query and update records across multiple tables in a single request. The code injection flaw allows an attacker to embed arbitrary code within a crafted GraphQL query. When the server processes the query, the injected code executes in the Now Platform application server context with access to all instance data, all integrations, and all stored credentials. No authentication token is required to reach the GraphQL endpoint in affected configurations.

CVE-2026-18886 resides in the image upload processor, a component that handles binary file ingestion for attachments and UI customization. The improper access control flaw allows an unauthenticated request to bypass the authorization check gating file processing, then use the upload mechanism to create or modify instance data. This attack surface is particularly dangerous because ServiceNow deployments store workflow automation logic, HR records, financial approval data, and integration API keys as structured instance data.

CVE-2026-74820 is a SQL injection via the ORDER BY clause in the dynamic schema query layer. ServiceNow constructs dynamic SQL queries when responding to Table API and GlideRecord requests, and the ORDER BY parameter in the affected code path is not properly sanitized. An unauthenticated attacker crafts a request that causes the ORDER BY clause to execute arbitrary SQL against the underlying database, including reading tables outside the intended query scope. That database holds every service management record, every user account, every integration credential, and all custom application data stored in the instance.

The ServiceNow CVE-2026-6875 pre-auth RCE published earlier this year established that the Now Platform API surface is a consistent and high-value attacker target once exploitation patterns are documented.

The August 27 advisory covers the Now Platform and ServiceNow AI Platform across four currently supported release families. ServiceNow cloud-hosted Software as a Service and Managed Instance environments were automatically patched on August 27. No action is required for cloud customers; the exposure applies exclusively to self-managed deployments.

Vulnerable builds by release family:

Xanadu: all builds before Patch 11 Hot Fix 7a.

Yokohama: builds before Patch 12 Hot Fix 3b; builds before Patch 13 Hot Fix 4.

Zurich: builds before Patch 7b HF3, Patch 8 HF5, Patch 9 HF6, Patch 10 HF2m, Patch 10 HF3, Patch 11, or Patch 12.

Australia: builds before Patch 2 HF3, Patch 3 HF2, Patch 3m, Patch 4, or Patch 5.

CVE-2026-6876 (CVSS 8.7 sandbox escape) applies to the same release families with the same version boundaries. Any account that can authenticate to an unpatched instance can trigger the sandbox escape and chain it with post-exploitation from the three unauthenticated flaws above.

Organizations running ServiceNow in on-premises or containerized deployments should inventory all instances, including development, staging, and integration environments that expose the Now Platform API to internal networks. These environments receive patches on a different schedule from production and frequently lag by weeks, creating an exploitable path into internal infrastructure from any host that can reach the dev environment.

ServiceNow stated in the August 27 advisory that it is not currently aware of exploitation of CVE-2026-18885, CVE-2026-18886, or CVE-2026-74820. That statement reflects the disclosure window, not the exploitation timeline. CVE-2026-6875, a sandbox escape fixed in July 2026, was exploited in the wild within five days of the patch release, with the first exploitation attempts observed on July 18, just five days after ServiceNow released self-hosted security updates on July 13.

The mechanism is consistent across enterprise platforms: once a patch ships, security researchers and adversaries both analyze the diff to reconstruct the vulnerability and build working exploits. For ServiceNow specifically, the GraphQL API and the Table API are well-documented, developer-accessible interfaces designed for external integration. That same accessibility means an attacker who understands the code injection sink in the GraphQL Composite Data API has a clear, well-lit path to a working exploit without needing to reverse-engineer undocumented internals.

The stakes reach beyond a typical web server compromise. ServiceNow holds the operational backbone of IT service management for its enterprise customers: active incidents and problem records, change management approvals, HR onboarding workflows, financial approval chains, and integration credentials for Active Directory, Azure Entra, cloud platforms, and monitoring infrastructure. An attacker who achieves unauthenticated code execution on a ServiceNow instance can extract those integration credentials, move laterally into connected systems, and impersonate service account identities across the enterprise without touching a single endpoint.

The Citrix NetScaler CVE-2026-8452 SAML RCE disclosed last week followed the same exploitation cadence: a patch shipped weeks earlier, a public PoC appeared, and exploitation began within 24 hours. The window is narrow.

ServiceNow has not published confirmed attacker infrastructure, file indicators, or hashes for these vulnerabilities as of August 30, 2026. No in-the-wild exploitation has been confirmed for CVE-2026-18885, CVE-2026-18886, or CVE-2026-74820. The indicators below are behavioral: patterns derived from the documented attack mechanism of each flaw that defenders can use to detect active exploitation attempts against their instances.

Review ServiceNow access logs and application event logs for the following patterns. The GraphQL endpoint indicator (CVE-2026-18885) is the highest priority: POST requests to /api/now/graphql from sessions without a valid JSESSIONID cookie, originating from external IPs. The image upload processor indicator (CVE-2026-18886) looks for POST requests to upload endpoints from unauthenticated sessions followed by unexpected record creation events in ServiceNow audit logs. The SQL injection indicator (CVE-2026-74820) looks for ORDER BY clauses in Table API requests containing SQL metacharacters or subquery patterns.

Also check the ServiceNow syslog_transaction table for any records showing API calls from the guest or null-session user context after August 27. Guest-context API activity that touches data write endpoints is abnormal and warrants immediate investigation.

No CVE-specific community Sigma rules exist for CVE-2026-18885, CVE-2026-18886, or CVE-2026-74820 yet. These vulnerabilities were disclosed August 27, 2026, and SigmaHQ community coverage typically requires confirmed exploitation indicators that arrive weeks after initial disclosure. The two rules below were generated by Decryption Digest from the documented attack mechanisms. Validate against your ServiceNow access log format and baseline legitimate API traffic before production deployment. Both carry status: experimental.

Rule 1 targets unauthenticated POST requests to the ServiceNow GraphQL endpoint, the network-layer signal for CVE-2026-18885 exploitation. Rule 2 targets SQL injection patterns in Table API query parameters for CVE-2026-74820.

The WAF rules below target both attack patterns across seven platforms. Deploy in log or count mode first, review false positives against your ServiceNow integration traffic baseline, and promote to block after validation. ServiceNow environments that restrict Table API access to internal networks can apply network-layer controls as a compensating measure while patching proceeds.

ServiceNow patched CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, and CVE-2026-6876 across all active release families. Cloud-hosted instances were updated automatically on August 27. Self-hosted deployments require manual patching via the Now Support portal. The steps below apply to Xanadu, Yokohama, Zurich, and Australia release families.

Customers on cloud-hosted or Managed Instance configurations do not need to take action but should confirm the patched build is running by navigating to System Diagnostics > Upgrade History in the ServiceNow admin console and verifying the installed build matches the version listed in KB3152242.

ServiceNow is not a web server at the network perimeter. It is the operational backbone of IT service management: the system where incidents are logged, change requests approved, employee onboarding credentials provisioned, and integration API tokens stored. An attacker who achieves unauthenticated code execution on a ServiceNow instance has reached something far more valuable than a web application server.

The GraphQL Composite Data API targeted by CVE-2026-18885 is designed to provide rich, cross-table access to all ServiceNow data in a single request. That breadth is its value for legitimate integrations and its danger under exploitation. An attacker who injects code through this endpoint can enumerate all stored records, extract integration credentials, read HR records, access pending change approvals, and trigger workflow automations. All without a valid account and without touching a single endpoint on the corporate network.

CVE-2026-74820 adds a parallel attack path. Arbitrary SQL against the ServiceNow database exposes the sys_user table (user accounts and password hashes), sys_connection_alias (integration credentials and API tokens), and all custom application data stored in the instance. For organizations storing ServiceNow data in a shared database alongside other application schemas, the blast radius extends further.

The pattern from the ServiceNow CVE-2026-6875 pre-auth RCE is the most relevant precedent: exploitation began within five days of patch release, with attackers scanning for the affected endpoint within hours of the disclosure. Organizations that treat ServiceNow patching as a quarterly maintenance item rather than an emergency response are operating outside the actual exploitation timeline. The window to patch before active attacks begin is measured in days.