Affected Systems

ServiceNow AI Platform (formerly Now Platform): Xanadu Patch 11, Yokohama Patch 12-13, Zurich Patch 7-12, Australia Patch 2-5. Affects cloud (auto-patched) and self-hosted instances. Used by 85% of Fortune 500 companies, powering 100,000+ enterprise AI apps.

Exploitation Status

No active exploitation reported by ServiceNow as of August 28, 2026. However, ServiceNow has a history of exploitation: CVE-2026-6875 (July 2026) and CVE-2024-4879/5178/5217 (2024) were exploited in the wild. Public exploit availability for current CVEs not yet confirmed.

Business Impact

Three maximum-severity vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) allow unauthenticated attackers to execute arbitrary code, escalate privileges, and perform SQL injection with low attack complexity and no user interaction. Cloud instances are auto-patched; self-hosted deployments require manual updates. Given ServiceNow's role in enterprise workflows and prior exploitation history, risk of targeted attacks is high. A fourth high-severity flaw (CVE-2026-6876) enables sandbox escape with basic privileges.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately patch self-hosted ServiceNow AI Platform instances to the fixed releases listed in the advisory (Xanadu Patch 11 HF7a, Yokohama Patch 12 HF3b/Patch 13 HF4, Zurich Patch 7b HF3 through Patch 12, Australia Patch 2 HF3 through Patch 5).
  • Verify cloud-hosted ServiceNow instances have received automatic patches by checking the release version in the system dashboard.
  • Monitor ServiceNow instance logs for anomalous unauthenticated access attempts, unexpected code execution, privilege escalation events, and SQL injection patterns (e.g., unusual database queries, failed authentication followed by elevated actions).
  • Review ServiceNow API endpoint access logs for unauthorized data queries, especially following the July 2026 unauthenticated API access incident disclosure.
  • Implement network segmentation to limit exposure of ServiceNow instances and enforce least-privilege access controls for authenticated users to mitigate CVE-2026-6876 sandbox escape risk.