ServiceNow has announced patches for four vulnerabilities, including three critical code injection flaws in the ServiceNow AI platform, each with a maximum severity (CVSS score of 10/10).
The first of the critical bugs, tracked as CVE-2026-18885, allows an attacker to execute arbitrary code in the ServiceNow platform under certain circumstances.
An attacker could exploit the weakness to gain access to and potentially modify arbitrary data, ServiceNow notes in its advisory.
The second critical defect, CVE-2026-18886, is described as an improper access control issue. It could allow an attacker to create or modify arbitrary data and elevate their privileges.
Tracked as CVE-2026-74820, the third critical vulnerability is an SQL injection flaw that allows an attacker to execute arbitrary SQL statements against the underlying ServiceNow database.
An attacker could exploit the bug to “gain access to, or modify, instance data beyond what was intended,” ServiceNow says.
According to the company, none of the three vulnerabilities requires authentication or user interaction. All three can be exploited in low-complexity attacks.
The fourth issue, tracked as CVE-2026-6876 (CVSS score of 8.7), is a high-severity sandbox escape weakness that could be exploited without authentication for code execution within the Now Platform.