Reported by 5 outlets

Timeline

1. original reporting

   ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection

   cyberpress.org · 46d ago · August 28th, 2026

   ServiceNow has released security updates for four vulnerabilities, including three rated critical, that could allow unauthenticated attackers to execute code, alter instance data, elevate privileges, or run arbitrary SQL commands against affected environments. The August 27, 2026 advisory addresses flaws tracked as CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. The issues affect components of the Now Platform and ServiceNow AI platform. ServiceNow said the vulnerabilities were discovered through its internal security research and responsible disclosure programs, and that each issue was remediated independently. ServiceNow Patches Critical Flaws CVE-2026-6876 is a high-severity sandbox escape flaw in the Now Platform. According to ServiceNow, the vulnerability could allow an unauthenticated attacker to execute arbitrary code on the platform and potentially gain access beyond intended security boundaries. Sandbox escape vulnerabilities are especially significant because they can break the isolation controls designed to restrict code execution and limit access to sensitive platform resources. The remaining three vulnerabilities are rated critical under the CVSS v4.0 calculator. CVE-2026-18885 is a code injection flaw in the ServiceNow AI platform that could, in certain circumstances, permit unauthenticated remote code execution. Successful exploitation could allow an attacker to access or modify instance data beyond the permissions intended by the platform. C

2. update from bleepingcomputer.com

   ServiceNow warns of three max severity security vulnerabilities

   bleepingcomputer.com · 46d ago · August 28th, 2026

   The ServiceNow AI Platform (formerly known as the Now Platform) is an enterprise-grade Platform-as-a-Service (PaaS) that helps integrate AI into core enterprise workflows and powers more than 100,000 enterprise AI apps at 85% of all Fortune 500 companies. In a Thursday advisory, the company said it patched its cloud-based platform against the three critical security flaws ( CVE-2026-18885 , CVE-2026-18886 , and CVE-2026-74820 ) and advised customers to secure their self-hosted instances. The first is a code injection vulnerability that can allow attackers to execute arbitrary code, the second stems from a code injection weakness that enables them to escalate privileges, and the third allows threat actors to access or modify instance data through SQL injection attacks. All three security vulnerabilities can be exploited by unauthenticated threat actors in low-complexity attacks that don't require user interaction. Release Version Updated Xanadu Patch 11 Hot Fix 7a Yokohama Yokohama Patch 12 Hot Fix 3b Yokohama Patch 13 Hot Fix 4 Zurich Zurich Patch 7b Hot Fix 3 Zurich Patc

3. update from gbhackers.com

   ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection

   gbhackers.com · 46d ago · August 28th, 2026

   ServiceNow reported that […] The post ServiceNow Patches Critical Flaws Enabling Unauthenticated RCE and SQL Injection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from malware.news

   ServiceNow security advisory (AV26-857)

   malware.news · 46d ago · August 28th, 2026

   Serial number: AV26-857 Date: August 28, 2026 As of August 27, 2026, ServiceNow is affected by vulnerabilities in the following products: Xanadu Versions prior to Patch 11 Hot Fix 7a Yokohama Versions prior to Yokohama Patch 12 Hot Fix 3b Versions prior to Yokohama Patch 13 Hot Fix 4 Zurich Multiple versions Australia Multiple versions The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. August 2026 CVE Advisory Notification ServiceNow security advisories Article Link: ServiceNow security advisory (AV26-857) - Canadian Centre for Cyber Security

5. mentioned by securityweek.com

   ServiceNow Patches 3 Critical Code Injection Vulnerabilities

   securityweek.com · 43d ago · August 31st, 2026