ServiceNow Patches Three CVSS 10.0 Platform Flaws

ServiceNow has patched three maximum-severity vulnerabilities in its Now Platform and AI Platform, each rated CVSS 10.0, that together allow an unauthenticated attacker to execute arbitrary code, escalate privileges, and read or tamper with instance data through SQL injection. The company published its advisory and remediation guidance in knowledge-base article KB3152242 on August 27, 2026, saying it had already patched its cloud-hosted instances and urging customers running self-managed deployments to apply the fixes immediately.

The severity is the story. A CVSS score of 10.0 is reserved for the worst class of flaw — one reachable over the network, trivial to exploit, and devastating in impact. For a platform that sits at the center of IT service management, HR workflows, and increasingly agentic AI automation across large enterprises, three of them at once is close to a worst case.

The three flaws

All three vulnerabilities share the same underlying profile: network-reachable, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. That combination is precisely what pushes a CVSS score to a perfect 10.0.

• CVE-2026-18885 is a code-injection flaw that lets an attacker execute arbitrary code on the affected instance. This is the classic remote-code-execution scenario: an unauthenticated request crafted to break out of the intended data context and run as an instruction instead.
• CVE-2026-18886 is a second code-injection weakness, this one enabling privilege escalation — allowing an attacker to gain rights beyond what any account should have and move deeper into the platform.
• CVE-2026-74820 is a SQL-injection vulnerability that permits a threat actor to access or modify instance data directly. Where the first two hand an attacker control of execution, this one hands them the database.

Chained together, the trio describes a full compromise path: get in without credentials, run code, elevate privileges, and read or rewrite the data underneath. On a platform that often stores identity records, approval workflows, configuration data, and integrations into other enterprise systems, that reach is the entire point of concern. If you need a refresher on the mechanics of the third bug, our explainer on what SQL injection is walks through how untrusted input slips into a query.

Why ServiceNow is a high-value target

ServiceNow is not a niche tool. It is one of the largest enterprise SaaS platforms in the world, running the service desks, HR case management, security operations, and IT workflows of a substantial share of the Fortune 500. A single instance frequently acts as connective tissue between dozens of other systems — pulling from identity providers, pushing tickets into engineering tools, and orchestrating approvals that touch finance and access control.

That centrality is what makes a maximum-severity flaw here so dangerous. An attacker who compromises a ServiceNow instance is rarely after ServiceNow alone; they are after the credentials, tokens, and trust relationships it holds to everything around it. The platform’s growing AI Platform layer — the agentic and automation features that let workflows act on their own — raises the stakes further, because those capabilities are designed to take actions across connected systems with minimal human review.

The pattern echoes a run of critical enterprise-software flaws this year, from the Citrix NetScaler pre-auth memory-disclosure bug that leaked live session tokens to a CVSS 10.0 SQL-injection zero-day in Metabase. The common thread is that the software holding an organization’s most sensitive workflows is exactly the software attackers most want to break.

No confirmed exploitation — yet

As of the advisory, ServiceNow has not reported active exploitation of the three flaws in the wild, and no proof-of-concept has been widely published. That is the good news, and it is the reason the disclosure reads as a race rather than an emergency.

It is a narrow window, though. Maximum-severity flaws in widely deployed platforms attract reverse-engineering almost immediately once a patch ships, because the fix itself often reveals where the bug lived. Defenders have repeatedly watched the gap between disclosure and exploitation collapse to days or even hours — the Citrix NetScaler flaw saw exploitation attempts within 24 hours of going public. The absence of confirmed attacks today is not a reason to wait; it is the reason to move now, before someone works backward from the patch.

What to do now

ServiceNow’s guidance splits along how an instance is hosted.

Cloud-hosted customers are largely covered. ServiceNow says it has already applied the fixes to its own managed infrastructure, so most instances running on ServiceNow’s cloud should be remediated without customer action. Even so, administrators should confirm their instance version against the advisory and review access logs for anomalies during the pre-patch window.

Self-hosted and self-managed customers carry the burden. Any organization running ServiceNow on infrastructure it controls needs to apply the patches referenced in KB3152242 as a priority, treating this as an out-of-band emergency rather than a routine maintenance item. Until patching is complete, sensible interim steps include tightening network exposure so instances are not reachable from the open internet, restricting inbound access to known ranges, and increasing monitoring on the endpoints most likely to be targeted.

Beyond the immediate fix, the episode is a prompt to revisit the blast radius. Because a ServiceNow compromise so often becomes a pivot into connected systems, the integrations, service accounts, and stored credentials the platform holds deserve a fresh audit. Rotating high-privilege tokens, scoping integration accounts to least privilege, and segmenting the platform from crown-jewel systems all limit how far an attacker could travel even if a future flaw slips through — the practical core of a zero-trust security posture.

What it means

Three CVSS 10.0 flaws in one advisory is a rare and sobering disclosure, and the fact that ServiceNow caught and patched them before evidence of exploitation surfaced is the best possible version of a bad situation.

Who is exposed. The sharpest risk sits with organizations running self-managed ServiceNow instances, especially any reachable from the public internet. They own the patch timeline, and the clock started the moment the advisory published. Cloud customers are mostly protected but should still verify rather than assume.

Who benefits. Attackers and access brokers benefit from every hour defenders delay, because a patched flaw in a high-value platform is a roadmap. Defenders who have already invested in network segmentation, least-privilege integration accounts, and tight monitoring benefit too — their exposure is smaller and their detection odds higher, regardless of this specific advisory.

What to watch next. First, whether a public proof-of-concept or in-the-wild exploitation emerges in the coming days, which would convert this from urgent to critical for anyone still unpatched. Second, whether CISA adds any of the three CVEs to its Known Exploited Vulnerabilities catalog, a signal that would compel federal agencies — and prod everyone else — to remediate on a deadline. And third, the broader question the AI Platform raises: as enterprise software gains agentic capabilities that act across connected systems on their own, the consequences of a single maximum-severity flaw grow with it. The patch closes these three holes. The trend that produced them is not going anywhere.