ServiceNow Patches Multiple Critical Vulnerabilities in Now Platform and AI Platform
ServiceNow disclosed several critical vulnerabilities affecting the Now Platform and ServiceNow AI Platform on August 27. The issues include unauthenticated code injection via the GraphQL Composite Data API, improper access controls during system image uploads, and SQL injection flaws that allow arbitrary database queries. Four CVEs were published: CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. Exploitation of CVE-2026-18885 could permit remote code execution and data manipulation without authentication under certain conditions. CVE-2026-18886 enables unauthorized data creation, modification, and privilege escalation, while CVE-2026-74820 allows direct SQL execution against the underlying database. ServiceNow has released updated versions to address the flaws.
Security NEXTAug 28, 2026Translated from Japanese