ServiceNow warns of three max severity security vulnerabilities

ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation attacks.

The ServiceNow AI Platform (formerly known as the Now Platform) is an enterprise-grade Platform-as-a-Service (PaaS) that helps integrate AI into core enterprise workflows and powers more than 100,000 enterprise AI apps at 85% of all Fortune 500 companies.

In a Thursday advisory, the company said it patched its cloud-based platform against the three critical security flaws (CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820) and advised customers to secure their self-hosted instances.

The first is a code injection vulnerability that can allow attackers to execute arbitrary code, the second stems from a code injection weakness that enables them to escalate privileges, and the third allows threat actors to access or modify instance data through SQL injection attacks.

All three security vulnerabilities can be exploited by unauthenticated threat actors in low-complexity attacks that don't require user interaction.

On Thursday, ServiceNow also addressed a high-severity sandbox escape security issue (CVE-2026-6876) affecting the same platform that could let attackers with basic privileges gain remote code execution on targeted systems.