ServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation attacks.
The ServiceNow AI Platform (formerly known as the Now Platform) is an enterprise-grade Platform-as-a-Service (PaaS) that helps integrate AI into core enterprise workflows and powers more than 100,000 enterprise AI apps at 85% of all Fortune 500 companies.
In a Thursday advisory, the company said it patched its cloud-based platform against the three critical security flaws (CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820) and advised customers to secure their self-hosted instances.
The first is a code injection vulnerability that can allow attackers to execute arbitrary code, the second stems from a code injection weakness that enables them to escalate privileges, and the third allows threat actors to access or modify instance data through SQL injection attacks.
All three security vulnerabilities can be exploited by unauthenticated threat actors in low-complexity attacks that don’t require user interaction.
On Thursday, ServiceNow also addressed a high-severity sandbox escape security issue (CVE-2026-6876) affecting the same platform that could let attackers with basic privileges gain remote code execution on targeted systems.
“We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so,” the company said.
While ServiceNow didn’t flag any of the vulnerabilities patched on Thursday as actively exploited, multiple security flaws in ServiceNow products have been targeted in attacks in recent years.
Two years ago, threat actors chained three ServiceNow flaws (CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217) using publicly available exploits to breach private firms and government agencies worldwide in data theft attacks.
More recently, in July, threat intelligence company Defused reported that attackers are now exploiting another critical vulnerability (CVE-2026-6875), a pre-auth sandbox escape in the ServiceNow AI Platform.
ServiceNow has also privately disclosed a security incident last month in which security researchers or customer-led research used an unauthenticated access flaw via a vulnerable API endpoint to query data from customer instances.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Critical ServiceNow code execution flaw now exploited in attacks
Critical Avada WordPress theme flaw enables zero-click RCE
CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday
Hackers now exploit critical Gitea flaw in code injection attacks
Hackers breached over 270 Zimbra servers in ongoing attacks
Ubiquiti patches three max severity security vulnerabilities
Police arrests dozens of suspects in global cybercrime crackdown
Massive DDoS attack disrupts Norway’s government digital services
Learn how ESET MDR can enhance your organization’s security posture
Overdue a password health-check? Audit your Active Directory for free
Discover how least agency keeps your AI tools capable, controlled, and secure.
Discover why encryption and key management are critical for modern business.
Protect yourself from data brokers, scammers, and the next data breach with digital identities.
Pixellot discovered and secured hundreds of unmanaged AI agent identities in weeks, not months. Download the case study for how.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
