Unauthenticated RCE, Privilege Escalation, and SQL Injection in ServiceNow AI Platform: Three CVSS 10.0 Vulnerabilities

1. Basic Information

• Article Title: ServiceNow Patches 3 Critical Code Injection Vulnerabilities
• Source: SecurityWeek
• Publication Date: 2026-08-31
• Original Article: SecurityWeek
• Related Sources: ServiceNow August 2026 CVE Advisory, BleepingComputer
• Related Malware, Threat Groups, CVEs, Products: CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876, ServiceNow AI Platform, Now Platform
• Severity: Critical

2. Executive Summary

ServiceNow patched three unauthenticated CVSS 10.0 vulnerabilities—code injection in the GraphQL Composite Data API, an access control flaw in configuration image upload processing, and SQL injection in dynamic schema ORDER BY clauses—along with an unauthenticated sandbox escape in the ServiceNow AI Platform.

3. Attack Flow

From Unauthenticated Request to Instance Compromise

1. An attacker sends a crafted request to an externally accessible ServiceNow AI Platform.
2. CVE-2026-18885 causes code injection in the GraphQL Composite Data API.
3. CVE-2026-18886 exploits an access control flaw in configuration image upload processing to create and modify data and escalate privileges.
4. CVE-2026-74820 injects SQL into dynamic ORDER BY clauses to manipulate the underlying database.
5. CVE-2026-6876 escapes the sandbox to execute code within the Now Platform.
6. Successful exploitation can spread to instance data, integration credentials, approval workflows, and external systems. Active exploitation is not observed.

4. Attacker Position and Execution Context

• An unauthenticated external attacker with network access to the HTTP(S) endpoint of the ServiceNow instance.
• Operates with the privileges of the Now Platform or the underlying database upon successful exploitation.

5. Visibility for Victims and Administrators

Victims

• Because exploitation requires no user interaction, it may appear on the screen as unauthorized changes to data, settings, permissions, or approval workflows.

Administrators

• Clues include abnormal GraphQL requests, configuration image uploads, errors involving ORDER BY clauses, and data modifications or privilege escalations originating from unauthenticated sessions.

6. Conditions for Success and Failure

Conditions for Success

• Network reachability to the vulnerable ServiceNow environment.
• The applicable hotfix is not installed.
• WAF or API controls do not block the crafted requests.

Conditions for Failure / Risk Mitigation

• Apply the hotfix provided by ServiceNow and verify the patched version.
• Restrict external exposure of administration, API, and upload functions to required sources only.
• Enable auditing for GraphQL, file uploads, SQL errors, and permission changes.

7. What Happens Upon Success

• Arbitrary code execution.
• Reading, creation, and modification of instance data.
• Privilege escalation and tampering with approval workflows.
• Arbitrary SQL execution on the underlying database and impact on external integrations.

8. Observable Logs

• Email: No emails are required to exploit these vulnerabilities. Abnormal notification or approval emails after compromise can be useful.
• Proxy/SWG/DNS: Low-frequency abnormal requests from external sources to ServiceNow API, GraphQL, or upload endpoints.
• Endpoint/EDR: For self-hosted instances, check for suspicious child processes of ServiceNow, file creation, and script execution.
• Identity/IdP: New high-privilege users, role assignments, sessions, or integration credential usage immediately following unauthenticated requests.
• SaaS/Cloud: Execution history for GraphQL, image uploads, audits, data changes, role changes, and IntegrationHub.
• Network: Outbound traffic from ServiceNow to unknown destinations or unusual integration endpoints.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Only reconnaissance or error requests to vulnerable endpoints are confirmed; no data modification or code execution is observed.
• User Interaction Confirmed: Authentication and user interaction are not required.
• Initial Execution Confirmed: Evidence of vulnerable processing is confirmed, such as code injection, SQL execution, or unauthorized data creation.
• Malware Execution or Authentication Success Confirmed: Code execution in the Now Platform, sandbox escape, or a newly created high-privilege session is confirmed.
• Data Theft or Session Compromise Confirmed: Retrieval or modification of instance data, or the use of credentials and sessions, is confirmed.
• Subsequent Compromise Confirmed: Intrusion into external integrations, persistence, approval workflow tampering, or additional payloads are confirmed. Active exploitation is not confirmed at the time of publication.

10. Investigation Playbook

• Trigger: Detect unauthenticated abnormal GraphQL requests, configuration image uploads, SQL errors, or permission changes.
• Initial Verification: Check instance version, hotfix status, exposure scope, initial abnormal requests, and ServiceNow application status.
• Endpoint: Preserve self-hosted application logs, child processes, file modifications, and database audits.
• Authentication & Cloud: Investigate changes to users, roles, API tokens, integration credentials, approval workflows, and new sessions.
• Subsequent Actions: Check for data retrieval, outbound traffic, abnormal authentication on integrated systems, persistence, and additional code.
• Containment: Apply hotfixes, revoke suspicious sessions and credentials, and restore compromised data, roles, and approval workflows.
• Determination Categories: Differentiate between reconnaissance, vulnerable processing, successful code/SQL execution, privilege escalation, data breach, and integration compromise.

11. Defense and Detection Ideas

• Single Event: An unauthenticated session accesses the GraphQL Composite Data API, configuration image uploads, or abnormal ORDER BY clauses.
• Time-Series Correlation: Correlate unauthenticated requests -> server error/code execution -> data modification -> role assignment -> external integration.
• Hunting: Search all instances for pre- and post-publication API, upload, SQL error, and user/role/token change activity.
• Log Gaps: Without connecting SaaS audit logs with self-hosted web, application, database, and OS logs, it is difficult to determine the success phase.
• Prioritized Measures: Apply hotfixes, restrict external exposure, audit APIs, set up high-privilege change alerts, and enforce the principle of least privilege for integration credentials.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-18885 is a code injection vulnerability in the GraphQL Composite Data API that allows unauthenticated attackers to execute code and access or modify instance data.
• CVE-2026-18886 is an access control flaw in system configuration image upload processing that allows unauthenticated attackers to create and modify arbitrary data and escalate privileges.
• CVE-2026-74820 is a SQL injection vulnerability reaching dynamic schema ORDER BY clauses, allowing arbitrary SQL execution on the underlying database.
• CVE-2026-6876 is a CVSS 8.7 sandbox escape that leads to unauthenticated code execution within the Now Platform.
• ServiceNow has already deployed updates to hosted instances and provided hotfixes for self-hosted environments in the Xanadu, Yokohama, Zurich, and Australia release series.
• ServiceNow is not aware of any active exploitation at the time of publication.

Inference

• In environments where ServiceNow aggregates data and permissions for HR, procurement, financial approvals, and external integrations, the compromise of a single instance can impact multiple business operations.

Hypothesis

• Detailed PoCs or exploitation telemetry may lead to an early increase in attacks, but no active exploitation has been confirmed at this time.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (High): Unauthenticated exploitation of vulnerable GraphQL, image processing, SQL, and sandbox features.
• T1059 Command and Scripting Interpreter (Medium): Can occur following code execution via CVE-2026-18885 and CVE-2026-6876, though no exploit commands have been publicly released.
• T1505.003 Server Software Component: Web Shell (Low): Possible as an example of persistence, but not observed in this incident.

14. Unknowns and Additional Investigation

• Presence of active exploitation, attack payloads, HTTP request details, and completion time of updates in hosted environments.
• Required minimum hotfixes for each release series must be verified via ServiceNow individual CVE records and the customer portal.

15. Impact on SOCs and General Organizations

Organizations often rely on ServiceNow as the core for human resources, ITSM, procurement, financial approvals, and external integrations. For self-hosted environments, apply hotfixes immediately without waiting for regular maintenance cycles, and review public GraphQL/API endpoints, image uploads, abnormal SQL queries, and administrator creation or permission changes.

16. Summary by Target Audience

• For SOCs: Monitor for anomalies in the GraphQL Composite Data API, configuration image uploads, dynamic ORDER BY clauses, and sandbox execution; correlate data modifications with privilege escalations.
• For Administrators: Verify update status for hosted instances and immediately apply hotfixes for the corresponding release series on self-hosted instances. Reduce the scope of external exposure.
• For Users: These vulnerabilities do not require user interaction. Report any suspicious changes in screens or approval workflows to the management department.