#Patch

ServiceNow drops urgent updates for trio of critical 10.0 flaws and sandbox escape

ServiceNow released security updates addressing four vulnerabilities in its AI Platform (formerly the Now Platform), including three maximum-severity flaws carrying a perfect 10.0 CVSS score. The trio of critical flaws comprises CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. Specifically, CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API enabling unauthenticated remote code execution and data tampering. CVE-2026-18886 involves improper access control in the system configuration image upload processor that allows unauthenticated actors to modify data and escalate privileges. Meanwhile, CVE-2026-74820 allows unauthenticated attackers to execute arbitrary SQL queries against the underlying database via a dynamic schema ORDER BY clause. Each of these three vulnerabilities is network-reachable with low attack complexity, requiring no prior privileges or user interaction. Alongside these, ServiceNow addressed CVE-2026-6876, a high-severity sandbox escape rated at 8.7 that allows arbitrary code execution. Affected major releases include Xanadu, Yokohama, Zurich, and Australia, spanning various patch and hotfix levels. ServiceNow has deployed automatic patches across its hosted cloud instances, but operators managing self-hosted infrastructure must deploy the fixes manually. While ServiceNow reported no known active exploitation for these specific flaws at publication time, prior platform flaws have frequently been targeted in the wild.