Three CVSS 10 unauth bugs in one ServiceNow advisory

Wednesday morning on August 27, a self-hosted ServiceNow admin at a mid-sized bank opens the security portal to a red bar across the top. Three bulletins in the AI Platform sit under it, all rated CVSS 10.0 and all reachable without a login: two run arbitrary code on the application server, the third runs arbitrary SQL against the database. Cloud tenants patched themselves overnight, so the exposed population from here on out is the self-hosted footprint that never migrated.

One advisory, three unauthenticated paths into the same platform

ServiceNow published KB3152242 on August 27, 2026 covering CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820. Each one carries a CVSS v4.0 score of 10.0, requires no authentication or user interaction, and lands in the AI Platform substrate that now sits between the GenAI features, the workflow engine, and the record store.

Three at once changes the calculus, because the advisory is not one primitive with three consequences; it is three separate reachable primitives against the same running instance. A fully patched box needs all three fixes, and a partially patched box that took only the emergency hot fix for the GraphQL bug still bleeds through the image processor and the ORDER BY clause. Because the SaaS side patched itself overnight, the entire remaining exposed population is the segment ServiceNow does not manage.

The GraphQL endpoint that ran arbitrary code on the platform

CVE-2026-18885 lives in the GraphQL Composite Data API, the ServiceNow endpoint that lets external systems query and update across multiple tables in a single request. That schema is expressive by design: a single POST can chain reads across incident, cmdb_ci, and sys_user, and the same request can produce writes back into any of them. The expressiveness is the entire product surface, and it is also the code path the vulnerability abuses.

An unauthenticated attacker sends a crafted POST to the GraphQL endpoint, and a payload embedded inside the Composite Data query runs inside the Now Platform application server process with no login prompt, no session cookie check, and no role validation between the request boundary and the injection sink. Result: arbitrary code execution against the platform that runs your workflows, holds your CMDB, and federates identity against your directory. The Hacker News, BleepingComputer, and CSO Online all confirm the same shape: unauthenticated code injection through the Composite Data API with full impact to confidentiality, integrity, and availability on the vulnerable component and every system connected to it. Downstream, that means MID Server keys, federated cloud IAM roles, Jira integration accounts, vCenter connectors, and Kubernetes API tokens all sit inside one HTTP request away.

The image upload processor that never asked who you were

CVE-2026-18886 is an improper access control flaw in the system configuration image upload processor, the component that handles binary ingestion for attachments and UI customization so a customer can push a company logo, a diagram, or a form image without going through a full record write. An unauthenticated attacker can create or modify instance data through the processor, which folds directly into privilege escalation because ServiceNow's authorization model treats writes to configuration records as trust decisions. The vulnerable path was never supposed to be reachable pre-auth in the first place; the platform accepted the input, wrote the record, and treated the result as a legitimate change, so no parser trick is required and the attacker only has to know the endpoint accepts them.

The dynamic ORDER BY that carries SQL back into the schema

CVE-2026-74820 is the SQL injection, and its root cause is a dynamic schema ORDER BY clause that incorporates user-influenced input without sanitization. ORDER BY is the classic escape hatch for parameterized queries: ORM layers happily bind values for WHERE clauses and lists, then serialize the ORDER BY column as raw SQL because the query planner needs an identifier there and not a parameter. When that identifier is influenced by request input and the sanitization step assumes the identifier is safe, the attacker owns the query.

Concretely, an unauthenticated request reaches a code path that builds a query shaped like SELECT ... FROM sys_metadata ORDER BY {input}, where {input} is derived from the request without escaping. The injected SQL runs with the privileges of the ServiceNow database user, which owns the entire instance schema, so a single unauthenticated HTTP call can read every table and write every table.

Patch coverage and the versions that matter

Cloud instances were patched automatically on August 27. Self-hosted deployments, and any managed instance whose owner opted out of the ServiceNow Patching Program, have to apply builds manually. Per the KB3152242 bulletin and the summary tracked in the NHS England Digital cyber alert, the fixes are Xanadu Patch 11 Hot Fix 7a or later, Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4 or later, Zurich Patch 7b Hot Fix 3 through Patch 12, and Australia Patch 2 Hot Fix 3 through Patch 5. Any self-hosted instance below those builds is exposed on all three CVEs simultaneously.

Why a CVSS 10 alone tells you almost nothing about your exposure

Three CVSS 10.0s look like an immediate all-hands remediation ticket, and they are for the population still exposed. But most of the ServiceNow footprint in the world is SaaS, not self-hosted, and ServiceNow applied the fix on those tenants overnight. A queue that walks CVSS descending and pages the on-call rotation for every 10.0 will page you three times for a bug your provider closed while you were asleep, and once for an appliance in a lab that never touched production data. The signal is not "is this a 10?" It is "is the instance I own reachable, on an affected build, and does anything downstream care?" Answering that requires layers the raw score does not carry: deployment mode, release train, hot fix level, whether the GraphQL Composite Data surface is enabled, and what downstream systems the instance's integration accounts hold credentials for.

TRIS on this advisory, layer by layer

TRIS is the Threat and Risk Intelligence Scoring engine inside CVEasy AI. It runs the live inventory of every asset on your estate through the same intelligence signals a human analyst would weigh, and lands each finding in one of four action bands. Four TRIS layers decide these three CVEs.

Deployment mode. Cloud tenants patched on August 27 drop to the lowest band with the patch date as evidence, while self-hosted instances stay in the ACT tier until an inventory update carries the fixed build.

Release train and hot fix level. TRIS matches the exact Xanadu, Yokohama, Zurich, or Australia build reported through the discovery adapter against the patched build number in the advisory. An instance on Xanadu Patch 11 Hot Fix 7a drops out of the finding entirely; anything on Patch 11 Hot Fix 6 or 7 stays in the top band.

Feature surface. The GraphQL Composite Data API is not enabled on every instance in the wild, so TRIS credits instances that expose the endpoint through the ServiceNow reverse proxy or a direct route as reachable on CVE-2026-18885, and marks the others as reachable on the image processor and the ORDER BY clause only.

Exploitation status. ServiceNow reports no known in-wild exploitation as of the advisory date, per GBHackers, and no proven PoC has appeared in public repositories at time of writing. TRIS credits the finding for the unauthenticated attack surface and the vendor confirmation, but does not stack the top band's confirmed in-the-wild modifier until independent telemetry catches an exploitation attempt. An unauthenticated CVSS 10 without confirmed abuse is still ACT tier, and the same finding on the day a mass-scanning campaign lights up moves higher on its own without a manual retriage.

The output is the same three CVEs landing top-band ACT on an internet-exposed self-hosted Xanadu Patch 10 instance, and landing far lower on a sandboxed instance behind an internal load balancer with the fix already applied, without either operator having to justify why they moved the number.

Patch, hunt, rotate: the week ServiceNow admins were handed

• Apply the August 27 hot fixes on every self-hosted instance. Any appliance below Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4, Zurich Patch 7b Hot Fix 3 through Patch 12, or Australia Patch 2 Hot Fix 3 through Patch 5 is exposed on all three CVEs.
• Confirm the cloud tenants took the patch. Verify the fix appears in the tenant's own patch history record rather than a portal banner alone.
• Audit HTTP access logs for anomalous requests to each of the three vulnerable paths. Unauthenticated POSTs to the GraphQL Composite Data endpoint that return 200s outside your normal integration windows, POST volume to the system configuration image upload URL from source IPs that never appear in your admin audit, and query strings carrying SQL-shaped tokens against schema endpoints are all worth hunting.
• Rotate integration credentials on any instance that was reachable and unpatched. MID Server keys, cloud IAM keys federated through the instance, LDAP bind secrets, and integration account tokens are all readable from the code injection primitives; rotate them on any instance that stayed exposed between August 27 and the day the fix was applied.

How CVEasy AI surfaces this on your ServiceNow estate

CVEasy AI, the number one local-first CTEM platform, ingests the KB3152242 bulletin, the CVE records, and the reporting from The Hacker News, BleepingComputer, and CSO Online as first-class inputs. TRIS then scores each of the three CVEs against your actual inventory, matches every ServiceNow instance against its release train and hot fix level, and joins each one to the AI Platform feature surface and the downstream integration accounts it holds. A self-hosted Xanadu appliance below Patch 11 Hot Fix 7a with the Composite Data API exposed lands top-band ACT with the KB3152242 evidence attached, the three CVE identifiers on the finding, and the MID Server and cloud IAM crown-jewels cited on the blast-radius line. A hosted instance already on the patched hot fix sits in the tracked band as verification, not as noise. The scoring runs on your hardware, because your CMDB and integration credentials are the last things you want mirrored into a vendor SaaS.

Sources: ServiceNow KB3152242, The Hacker News, BleepingComputer, CSO Online, GBHackers, NHS England Digital, Secure ISS, Techzine.