Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

ServiceNow Releases Security Advisory for Critical Vulnerabilities in the ServiceNow Now and AI Platforms

Vulnerabilities could enable an unauthenticated attacker to perform arbitrary code execution, privilege escalation, or SQL injection.

Threat ID:
CC-4839
Threat Severity:
Medium
Published:
28 August 2026 3:07 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Vulnerabilities could enable an unauthenticated attacker to perform arbitrary code execution, privilege escalation, or SQL injection.

Threat details

Introduction

ServiceNow has released security updates to address critical vulnerabilities affecting the ServiceNow Now and AI platforms.

  • CVE-2026-6876 - 'Sandbox Escape' vulnerability - CVSSv4.0 Score: 8.7
  • CVE-2026-18885 - 'Code Injection' vulnerability - CVSSv4.0 Score: 10.0 
  • CVE-2026-18886 - 'Improper Access Control' vulnerability - CVSSv4.0 Score: 10.0 
  • CVE-2026-74820 - 'SQL Injection' vulnerability - CVSSv4.0 Score: 10.0

Remediation advice

Affected organisations are encouraged to review the ServiceNow KB3152242 advisory and apply relevant updates as soon as possible.

CVE Vulnerabilities

Status Published

CVE-2026-6876

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.   ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Status Published

CVE-2026-18885

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Status Published

CVE-2026-18886

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Status Published

CVE-2026-74820

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Last edited: 28 August 2026 3:07 pm