ServiceNow Patches 4 Flaws in AI Platform, Three Rated CVSS 10.0
TechNadu · x · 2026-08-29
ServiceNow has released patches for four security vulnerabilities impacting its ServiceNow AI Platform, three of which are rated critical with a CVSS score of 10.0.
Vulnerability Details:
- CVE-2026-18885 (CVSS 10.0): Code injection in the GraphQL Composite Data API allowing unauthenticated arbitrary code execution and data access/modification.
- CVE-2026-18886 (CVSS 10.0): Improper access control in the system configuration image upload processor leading to privilege escalation and data modification by unauthenticated users.
- CVE-2026-74820 (CVSS 10.0): SQL injection via a dynamic schema ORDER BY clause enabling arbitrary SQL statement execution.
- CVE-2026-6876 (CVSS 8.7): Sandbox escape in the Now Platform allowing arbitrary code execution.
Affected releases span Xanadu, Yokohama, Zurich, and Australia. Hosted instances have been updated, while self-hosted customers must apply the fixes manually.
Related event: ServiceNow Patches Four AI Platform Flaws, Three Rated CVSS 10.0(2 posts)→
More from Safety
- Anthropic red team's first-ever model "abliteration" cut GLM-5.3 refusals from 90% to 3% for ~$4,400 — cephaloform · 2026-10-16
- Anthropic grants METR employee-like access as independent safety evaluators go public — AnthropicAI · 2026-10-16
- APEX-Harm benchmark: script-based injection attacks easily compromise agents in shared workspaces — KAUST · 2026-10-16
- Residual-stream forecasts predict agent violations before they happen, USC study shows — USC · 2026-10-16
- AI safety drama: risk research called a 'company effort,' team lead responds — logangraham · 2026-10-16
- Brave's Leo adds end-to-end encrypted chat with GLM via attested TEE — gnukeith · 2026-10-16