Loading story…
ServiceNow released fixes for three CVSS 10.0 vulnerabilities in the Now Platform and ServiceNow AI Platform: CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. An unauthenticated attacker could exploit the low-complexity flaws without user interaction to execute arbitrary code, escalate privileges, or run SQL statements to access and modify instance data. The company also addressed CVE-2026-6876, a high-severity sandbox-escape vulnerability that could enable a basic-privileged user to achieve remote code execution.
Affected deployments span the Xanadu, Yokohama, Zurich, and Australia release families, including multiple patch and hot-fix levels. ServiceNow said it has no evidence that the vulnerabilities are being exploited in the wild, but urged customers—especially operators of self-hosted instances—to identify affected versions and apply the relevant hot fixes or upgrade to patched releases immediately.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-857 warning that ServiceNow products were affected by the vulnerabilities disclosed by ServiceNow. It identified affected Xanadu, Yokohama, Zurich, and Australia releases and urged administrators to review advisories and apply available updates.
ServiceNow disclosed CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, each rated CVSSv4 10.0, plus the CVSSv4 8.7 sandbox-escape flaw CVE-2026-6876. It issued fixes across the Xanadu, Yokohama, Zurich, and Australia release families and said it had no evidence of active exploitation.
ServiceNow previously addressed CVE-2026-6875, a pre-authentication AI Platform sandbox-escape vulnerability rated CVSSv4 9.5. Searchlight Cyber reported that exploitation could compromise a ServiceNow instance and potentially affect connected proxy or MID Server infrastructure.
ServiceNow reclassified CVE-2026-6876, an unauthenticated AI Platform sandbox-escape flaw that can enable code execution in the ServiceNow Platform context, from high to critical severity. The company continued to state it was unaware of active exploitation and urged customers to apply available patches.
Reporting associated ServiceNow's pre-authentication sandbox-escape vulnerability CVE-2026-6875 with exploitation attempts after its July 2026 disclosure, indicating attacker interest in the flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
13 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcecysecurity.news
Open sourcesecurityweek.com
Open sourcesocradar.io
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceacn.gov.it
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ServiceNow disclosed and remediated **CVE-2026-6875**, a critical sandbox escape in its AI Platform that can allow **unauthenticated remote code execution** in certain circumstances. The vulnerability affects both hosted and self-hosted ServiceNow environments, carries a **CVSS 4.0 score of 9.5**, and was published in advisory `KB3137947`. ServiceNow said it has already deployed security updates to hosted instances and issued patched family releases and updates for self-hosted customers and partners. The company said it is **not currently aware of active exploitation**, but warned that successful compromise could let attackers execute code within the ServiceNow platform, disrupt workflows, access sensitive data, modify records, and enable follow-on malicious activity. To reduce near-term exploit risk, ServiceNow limited public technical details while directing customers to promptly apply the relevant updates or upgrade to patched releases, including fixes for the **Brazil, Australia, Zurich, and Yokohama** release families.
Jul 21, 2026
ServiceNow customers were urged to patch multiple **critical remote code execution** vulnerabilities after reports that flaws in the platform were being **actively exploited**. One set of bugs affected core ServiceNow deployments and was serious enough to trigger immediate warnings from security researchers and industry media, highlighting the risk of unauthenticated or low-friction compromise in widely used enterprise workflow environments. A separate report later identified another **critical RCE vulnerability** in the **ServiceNow AI Platform**, expanding concern from the core platform to newer AI-enabled components. Together, the disclosures indicate that attackers have had viable paths to execute code against ServiceNow environments across both traditional and AI-related services, raising the stakes for organizations that use the platform for IT, HR, security, and business process automation.
Jun 29, 2026
ServiceNow patched a **critical unauthenticated remote code execution (RCE)** vulnerability in the *ServiceNow AI Platform* tracked as **CVE-2026-0542**. The flaw can allow an unauthenticated attacker, under certain conditions, to execute code within the **ServiceNow Sandbox**—a restricted environment intended to isolate untrusted code—creating risk of broader instance compromise, including potential data theft and workflow manipulation. Public technical details were limited, but the issue was characterized as remotely reachable (typically over HTTPS) and high impact, with reporting citing **critical severity (CVSS 9.8)**. ServiceNow’s advisory (**KB2693566**) states the company deployed security updates to affected **hosted customer instances** and also made updates available to **self-hosted customers and partners** via patches/hotfixes. As of the advisory information reflected in CVE tracking, ServiceNow reported it was **not aware of active exploitation against customer instances**, but recommended customers apply the relevant updates or upgrade promptly to mitigate the risk from an unauthenticated RCE path into the sandboxed execution environment.
Jun 29, 2026