ServiceNow Patches 3 Critical Code Injection Vulnerabilities

ServiceNow addressed four security vulnerabilities in its platform, three of which are critical code injection flaws with maximum severity (CVSS 10.0). CVE-2026-18885 allows arbitrary code execution under certain conditions. CVE-2026-18886 is an improper access control issue enabling data modification and privilege escalation. CVE-2026-74820 is an SQL injection vulnerability permitting execution of arbitrary SQL statements against the ServiceNow database, potentially exposing or modifying data beyond intended scope. None of these three require authentication or user interaction and can be exploited with low complexity. The fourth vulnerability, CVE-2026-6876, is a high-severity sandbox escape allowing code execution with elevated access. ServiceNow has deployed patches across hosted instances and released hotfixes for self-hosted versions including Xanadu, Yokohama, Zurich, and Australia releases.

Exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code on the ServiceNow platform, access and modify sensitive data, and escalate privileges. The SQL injection flaw could expose or alter database contents beyond intended permissions. The sandbox escape vulnerability could grant attackers broader access within the platform. These flaws pose a significant risk to data confidentiality, integrity, and platform control, especially given the lack of authentication requirements and low attack complexity.

ServiceNow has released official patches for all four vulnerabilities on hosted instances and hotfixes for self-hosted deployments. Customers should urgently apply these patches and hotfixes, especially for self-hosted instances running Xanadu, Yokohama, Zurich, and Australia releases. Security teams are advised to prioritize patching immediately rather than waiting for normal patch cycles to mitigate the risk of exploitation.