ServiceNow warns of three max severity security vulnerabilities

ServiceNow released security patches for three maximum-severity vulnerabilities in its AI Platform (formerly Now Platform): a code injection vulnerability allowing arbitrary code execution, a code injection flaw enabling privilege escalation, and a SQL injection vulnerability permitting unauthorized access or modification of instance data. All three can be exploited by unauthenticated attackers without user interaction. Furthermore, a high-severity sandbox escape vulnerability (CVE-2026-6876) was patched, which could allow attackers with basic privileges to achieve remote code execution. ServiceNow patched its cloud platform and advised customers to update self-hosted instances. No known active exploitation of these specific vulnerabilities has been reported.

Successful exploitation of these vulnerabilities could allow unauthenticated attackers to execute arbitrary code, escalate privileges, and access or modify sensitive instance data within the ServiceNow AI Platform. The sandbox escape flaw could enable attackers with limited privileges to gain remote code execution capabilities. These impacts pose significant risks to confidentiality, integrity, and availability of affected systems and data. However, ServiceNow currently reports no known active exploitation of these vulnerabilities.

ServiceNow has released official patches addressing these vulnerabilities for both its cloud platform and self-hosted instances. Customers are strongly advised to promptly apply the appropriate updates or upgrade to patched releases as specified in the vendor advisory. No additional mitigation steps are indicated beyond applying these patches. ServiceNow manages remediation for its cloud-hosted platform, and customers should verify patch status accordingly.