ServiceNow has fixed four security flaws in the platform many large organizations use to run their IT service desks, and its own security team scored every one of them at the top of the scale: CVSS 10.0. Three of the four can be reached by someone with no account and no password at all.
ServiceNow disclosed and patched them on 27 August. It says it pushed the update to the instances it hosts itself and supplied the same update to its partners and to customers running the platform on their own infrastructure. That last group is where the remaining exposure sits.
No account required, which is the point
CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API. In ServiceNow's own words, an unauthenticated user could in certain circumstances execute arbitrary code on the platform and reach or change instance data beyond what was intended. CVE-2026-74820 is a SQL injection flaw tied to a dynamic schema ORDER BY clause, letting an unauthenticated user run arbitrary SQL statements against the database sitting under the instance. CVE-2026-18886 is a broken access control in the component that processes system configuration image uploads, which allows an unauthenticated user to create or modify instance data and escalate privileges. The fourth, CVE-2026-6876, is an escape from the Now Platform scripting sandbox, the boundary that is supposed to stop code written inside the platform from touching the system around it.
What ServiceNow has not published is how any of this is actually reached. There is no public detail on the affected resolvers, the request structure or an exploitation chain, and no proof of concept code has appeared. The company says it is not currently aware of malicious exploitation against ServiceNow instances. Any account of how these bugs work that goes beyond the vendor's own description is guesswork and should be treated that way.
Why a service desk is worth the trouble
An IT service management instance is an unusually rich target. It holds the asset inventory, the change records, the ticket history with whatever credentials hurried engineers pasted into it, and the service accounts wired into everything else. A platform that can alter records across all of that, reachable by anyone who can route to it, is a short path from outside to inside. That is why enterprise suites keep drawing maximum severity ratings, from a critical SAP flaw allowing a full Commerce Cloud takeover to Oracle's August update, which carried 943 fixes and one perfect 10 of its own.
Check the hot fix, not the release
The corrected builds are listed in ServiceNow's advisory, KB3152242, and they are branch specific. The Xanadu, Yokohama, Zurich and Australia families each carry their own combination of patch and hot fix. The trap is that sitting on the right major release is not enough: a fixed build is a particular patch plus a particular hot fix, so administrators need to check the exact release, patch, hot fix and branch of every instance against the KB rather than assume an upgrade covered it.
Peru's National Digital Security Centre carried the same message nationally on 2 September in its integrated digital security alert 164-2026, telling organizations on self hosted or third party managed instances to confirm the hot fixes were genuinely applied rather than assumed, and to review whether the GraphQL, image processing, dynamic schema and scripting components need to be reachable at all.
Nobody has shown these flaws being used, and ServiceNow got in front of them. That is the good version of this story. The less comfortable version is that an unauthenticated route into a system which knows where everything in an organization lives is exactly the kind of thing that gets studied once a patch is public, and every unpatched self hosted instance is still sitting on the wrong side of that clock.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.