As reported by The Hacker News, ServiceNow disclosed four vulnerabilities on August 27, 2026, three of which carry a perfect CVSS 4.0 score of 10.0 and are exploitable without authentication. This is not an isolated event — it follows CVE-2026-6875, a pre-auth sandbox escape patched in July, and signals a concerning pattern of foundational weaknesses in a platform that enterprises trust with some of their most sensitive operational data.
Vulnerability Summary
| CVE | CVSS | Type | Component | Auth Required |
|---|---|---|---|---|
| CVE-2026-18885 | 10.0 (Critical) | Code Injection | GraphQL Composite Data API | No |
| CVE-2026-18886 | 10.0 (Critical) | Improper Access Control / Privilege Escalation | System Configuration Image Upload Processor | No |
| CVE-2026-74820 | 10.0 (Critical) | SQL Injection | Dynamic Schema ORDER BY Clause | No |
| CVE-2026-6876 | 8.7 (High) | Sandbox Escape | Now Platform | No |
Patch status: ServiceNow has deployed fixes to its hosted instances automatically. Self-hosted customers and partners must apply the update manually. No evidence of active exploitation of these four CVEs has been confirmed, though the prior CVE-2026-6875 saw disputed in-the-wild activity — initially reported by Defused, later clarified as matching a published PoC rather than independent threat actor exploitation.
Why This Matters
ServiceNow is not a peripheral tool — it is core IT service management, HR workflow, and customer service infrastructure for a significant portion of the Fortune 500. A platform-level unauthenticated code execution flaw means an attacker could potentially pivot from external network access to full instance compromise, data exfiltration, and lateral movement into connected enterprise systems. The GraphQL API attack surface is particularly notable: GraphQL endpoints are increasingly exposed to the internet for integration purposes, and input validation at composite resolver layers has historically been a weak point across vendors.
The SQL injection flaw via a dynamic schema ORDER BY clause is equally significant. ORDER BY injection is a well-understood class of vulnerability, but its presence in a platform of this scale suggests that dynamic query construction patterns in the Now Platform may need systematic review rather than point fixes.
The recurring sandbox escape theme — CVE-2026-6875 in July, CVE-2026-6876 now — indicates that the platform's isolation boundaries between customer scripts and the underlying runtime may not be as robust as the trust placed in them demands.
Who Is Most Exposed
Immediate Actions
- Verify patch status today. Self-hosted administrators should confirm the August 27 update is applied. Hosted customers should verify with their ServiceNow account team that their instance received the automatic deployment.
- Audit external exposure. Identify any ServiceNow endpoints reachable from the internet — GraphQL APIs, REST endpoints, and web interfaces. Restrict access using IP allowlisting or VPN where feasible.
- Review authentication boundaries. Confirm that anonymous/public access is disabled for system configuration interfaces and that the image upload processor is not exposed to unauthenticated sessions.
- Deploy WAF rules. If patching cannot occur immediately, implement virtual patching rules targeting GraphQL query structure anomalies, ORDER BY parameter injection patterns, and unauthorized image upload requests.
- Hunt for indicators of prior compromise. Review instance logs for anomalous GraphQL queries, unexpected schema modifications, unusual SQL activity, and sandbox escape artifacts. The disputed CVE-2026-6875 activity suggests threat researchers are actively probing this platform.
Shield53 Recommendations
Beyond immediate patching, organizations should treat this disclosure as a catalyst for structural changes in how they manage ServiceNow security:
- Establish a ServiceNow-specific vulnerability response runbook with defined SLAs for platform patches, given ServiceNow's emerging pattern of critical disclosures.
- Implement continuous attack surface monitoring for all ServiceNow instances, including partner-hosted environments, to detect new external exposure.
- Conduct a platform security review focusing on script inclusion policies, sandbox configuration, and custom code that may interact with the vulnerable components.
- Engage with ServiceNow's Trust Portal proactively rather than reactively — subscribe to advisory notifications and maintain a relationship with your security liaison.
- Pressure-test DR/IR procedures for a scenario where a core platform like ServiceNow is compromised. Many organizations have never exercised this playbook despite the concentration of risk.
The concentration of three CVSS 10.0 flaws in a single advisory, following a related critical disclosure weeks earlier, should give every ServiceNow customer pause. Platform trust is earned through transparency and response — and defenders should match ServiceNow's patching urgency with their own operational diligence.
