The short answer
ServiceNow disclosed three distinct CVSS 10.0 vulnerabilities in its AI Platform on August 27, 2026. All three require no authentication and no user interaction, and all three target different attack surfaces: the API layer, the file upload subsystem, and the database query engine. ServiceNow-hosted (SaaS) instances were auto-patched before the disclosure. If your organization runs a self-hosted ServiceNow deployment — common in enterprises with data residency requirements or strict change-control policies — manual patching is required now. NHS England issued cyber alert CC-4839 on the same day, signaling recognized EU enterprise exposure.
Three simultaneous CVSS 10.0 findings in a single platform release cycle is rare. Any single one of these would be a patch-immediately event; receiving all three in the same advisory means self-hosted ServiceNow is the highest-priority item on your patching queue this week.
The three CVSS 10.0 flaws
Each vulnerability is independent: exploiting one does not require the others, and they target different parts of the platform. Together they illustrate how a broadly deployed enterprise platform can carry multiple critical-risk surfaces that security reviews may not have touched since the last major version upgrade.
CVE-2026-18885 — Code injection via GraphQL Composite Data API
The most impactful of the three, CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API, a query interface used by custom integrations, internal dashboards, and ServiceNow Flow Designer workflows. An unauthenticated attacker who can reach the API endpoint can inject and execute arbitrary code on the platform, with the ability to read and modify data across the instance. No authentication token, no special header, no insider knowledge of the target — just network access and the request. For organizations running security audits of their enterprise platforms, GraphQL endpoints have historically been under-tested compared to REST APIs; this CVE is a concrete example of that gap becoming exploitable.
CVE-2026-18886 — Improper access control in config image upload
CVE-2026-18886 targets the system configuration image upload processor — a low-profile administrative function. The access control check for this endpoint can be bypassed by an unauthenticated request, allowing an attacker to upload files and escalate privileges on the instance. The practical consequence is the same as CVE-2026-18885 for an attacker who wants control of the platform: a different path to the same outcome, making partial mitigations that address only one surface insufficient.
CVE-2026-74820 — SQL injection via dynamic schema ORDER BY
CVE-2026-74820 is a SQL injection vulnerability in how ServiceNow constructs ORDER BY clauses for dynamic schema queries. An unauthenticated attacker can manipulate the clause to run arbitrary SQL against the underlying database. This creates a direct path to data exfiltration — records, attachments, user data, integration credentials stored within ServiceNow — without needing to execute code. For enterprises storing HR data, IT asset records, or contract data in ServiceNow, this flaw has immediate data-breach implications if exploited before patching.
Exploitation risk and patch status
ServiceNow stated that no active exploitation had been detected as of the August 27 advisory. That window should not be interpreted as a deferral opportunity. All three vulnerabilities have CVSS attack complexity rated as low, meaning no special conditions or insider access are required — once a working proof-of-concept becomes public, which typically follows within days to weeks of a high-profile advisory, the exploitation barrier drops to commodity level.
Hosted (Now Platform cloud) instances were patched by ServiceNow before the public disclosure. Self-hosted deployments — which include on-premises installations and customer-managed cloud instances where ServiceNow provides the software but the customer controls patching — require customers to apply updates manually using the update sets published in the ServiceNow Knowledge Base (KB3152242 and associated articles).
The NHS England CC-4839 alert issued the same day as the disclosure is a practical indicator: UK health sector organizations, many of which run self-hosted ServiceNow for data residency reasons, were immediately flagged as requiring emergency response. The same reasoning applies to any regulated enterprise in the EU or US running self-hosted ServiceNow.
Who is affected
The vulnerabilities affect the ServiceNow AI Platform. Enterprises most directly at risk are those running self-hosted or on-premises ServiceNow deployments. This includes organizations with strict data residency requirements (common in EU healthcare, financial services, and public sector), organizations subject to contractual restrictions on cloud data processing, and enterprises that delayed migration to SaaS-hosted ServiceNow for change-control or compliance reasons.
Organizations using ServiceNow exclusively via the hosted SaaS offering are protected for the current advisory cycle. However, custom integrations that expose ServiceNow APIs to external systems — a common pattern in enterprise software development — should be reviewed to ensure no custom middleware is re-exposing the vulnerable surfaces through a proxy or gateway layer.
What it means for US & EU software teams
ServiceNow sits at the center of ITSM, HR, and DevOps workflows in large enterprises across both markets. A compromised ServiceNow instance is not a peripheral risk: it holds service accounts, integration credentials, HR data, incident records, and often has bidirectional integrations with identity providers, cloud infrastructure, and financial systems. The blast radius of an unauthenticated exploit on a self-hosted instance spans far beyond the ITSM tool itself.
For EU enterprises, the GDPR analysis is immediate. If CVE-2026-74820's SQL injection path reaches personal data — and in any ServiceNow instance used for HR, employee IT support, or customer service, it likely does — a successful exploit is a personal data breach under GDPR Article 4(12). The Article 33 notification clock (72 hours to supervisory authority) starts when the controller becomes aware, not when exploitation is confirmed. For NIS2-scoped entities, leaving three publicly known maximum-severity flaws unpatched on a core enterprise platform is difficult to characterize as the "appropriate technical measures" required under Article 21.
For US enterprises, ServiceNow instances used in federal contracting environments or those certified under FedRAMP are subject to mandatory patch windows for CVSS critical-severity vulnerabilities. Even outside federal context, SOC 2 Type II assessments increasingly reference known-exploitable vulnerabilities in third-party enterprise platforms: an unpatched CVSS 10.0 flaw on a system in scope will generate an exception that requires explanation to auditors and customers.
What to do now
- Identify your ServiceNow deployment type. Confirm whether your organization runs a hosted SaaS instance, a self-hosted deployment, or a hybrid. Hosted = auto-patched. Self-hosted = manual action required. Check with your ServiceNow administrator or your internal platform team today.
- Apply ServiceNow patches immediately for self-hosted instances. Retrieve and apply the update sets from the ServiceNow Knowledge Base (KB3152242 and linked articles). If your change-control process requires a change request, initiate an emergency CR now rather than waiting for the next scheduled maintenance window. All three CVEs are CVSS 10.0 — the highest possible severity — and justify emergency procedures.
- Review access logs for the affected endpoints. Check logs for unusual unauthenticated requests to GraphQL Composite Data API endpoints, the config image upload path, and dynamic schema query endpoints in the period since the August 27 disclosure. If your logging does not capture API-level access separately, now is the time to verify that it does going forward.
- Audit custom integrations touching affected surfaces. Identify any middleware, API gateways, or custom connectors that route traffic to the ServiceNow GraphQL API or file upload endpoints from external systems. Ensure these integrations enforce authentication at the integration layer even when calling self-hosted ServiceNow endpoints.
- Trigger compliance workflows in parallel. Do not wait for confirmed exploitation before starting the compliance assessment. For GDPR-scoped organizations, open a preliminary incident record now and determine whether any personal data accessible via CVE-2026-74820's SQL injection path was potentially exposed during the period between vulnerability creation and patching. For NIS2-scoped entities, document the patching timeline to demonstrate proportionate response.
- Verify patching completeness. After applying updates, confirm patch success through the ServiceNow Health Check or your internal vulnerability scanner. Three simultaneous CVSS 10.0 flaws suggest an unusually broad advisory scope; verify the update set addressed all three CVEs, not just the most prominent one.
Frequently asked questions
What are CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 in ServiceNow?
Three separate maximum-severity vulnerabilities disclosed by ServiceNow on August 27, 2026. CVE-2026-18885 is code injection via the GraphQL Composite Data API (unauthenticated RCE and data access). CVE-2026-18886 is improper access control in the config image upload processor (unauthenticated privilege escalation). CVE-2026-74820 is SQL injection via dynamic schema ORDER BY (arbitrary SQL against the database). All three carry CVSS v4.0 scores of 10.0 and require no authentication or user interaction.
Are these ServiceNow vulnerabilities being actively exploited?
ServiceNow reported no active exploitation at the time of the August 27 disclosure. All three flaws have low attack complexity, meaning no special conditions are required. As technical details become more widely available following the advisory, the window before working exploits emerge typically narrows. Self-hosted deployments should treat patching as an emergency, not a scheduled task.
Which ServiceNow deployments are affected?
Hosted (Now Platform SaaS) instances were auto-patched by ServiceNow before the public disclosure. Self-hosted and on-premises deployments require customers to apply update sets manually via the ServiceNow Knowledge Base (KB3152242 and related articles). Hybrid configurations where the customer controls patching timelines are in the same category as self-hosted.
Why did ServiceNow receive three CVSS 10.0 scores at once?
The three CVEs target distinct attack surfaces: the API layer, the file upload subsystem, and the database query engine. Each independently achieves CVSS 10.0 because all share the same risk attributes — network-reachable, no authentication, no user interaction, low attack complexity. Three simultaneous 10.0 scores in a single advisory is unusual and reflects either a broad platform-level security audit finding or a period where multiple latent vulnerabilities converged in the same release cycle.
What do these flaws mean for GDPR and NIS2 compliance?
For GDPR-scoped organizations: if CVE-2026-74820's SQL injection path reaches personal data (likely in any HR or customer-facing ServiceNow use), a successful exploit constitutes a personal data breach under Article 4(12), triggering the 72-hour Article 33 notification obligation from the point the controller becomes aware. For NIS2-scoped entities: leaving three publicly known maximum-severity flaws unpatched on a core enterprise platform is difficult to defend as proportionate security under Article 21.
Should we audit ServiceNow integrations after this advisory?
Yes. Custom integrations that expose ServiceNow's GraphQL API or file upload endpoints to external systems should be reviewed to ensure authentication is enforced at the integration layer. Review whether any API gateway, middleware, or connector re-exposes the affected endpoints without the platform-level auth controls. If your logging does not capture granular API-level access, treat logging coverage as a parallel remediation item alongside patching.
Sources
The Hacker News — Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL, August 28, 2026
CSO Online — ServiceNow patches three maximum severity flaws that could put enterprise data at risk, August 2026