ServiceNow Discloses Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Remote Code Execution and SQL Injection
ServiceNow AI platform has been hit with three CVSS 10.0 vulnerabilities that allow unauthenticated remote attackers to execute arbitrary code and SQL commands, putting global enterprise ITSM deployments at immediate risk.
Many organizations run their entire IT service desk, ticket workflows, asset management, and parts of automated operations on a single ServiceNow instance. An attacker gaining control of this central system obtains not only data but also the operational console for the company’s IT processes.
Three maximum-severity flaws
On August 27, ServiceNow published an advisory covering four vulnerabilities. The three rated CVSS 10.0 are:
- CVE-2026-18885 – Code injection in the GraphQL Composite Data API that permits unauthenticated attackers to run arbitrary code and read or modify instance data.
- CVE-2026-18886 – Access-control flaw in the system configuration image upload processor allowing unauthorized users to create or alter instance data and escalate privileges.
- CVE-2026-74820 – SQL injection triggered through the ORDER BY clause of dynamic schemas, enabling unauthenticated attackers to execute arbitrary SQL against the underlying database.
A fourth issue, CVE-2026-6876 (CVSS 8.7), concerns sandbox escape on the Now platform and also permits unauthenticated code execution.
All three 10.0 flaws share the same CVSS 4.0 attack vector: network-reachable, low complexity, no privileges, and no user interaction required, with high impact on confidentiality, integrity, and availability.
Why the disclosure is especially concerning
ServiceNow serves as the core ITSM platform for numerous large enterprises. Full compromise therefore grants attackers control over ticket handling, change management, CMDB assets, and security orchestration workflows.
The disclosure follows a July report of another pre-authentication sandbox escape (CVE-2026-6875) that threat intelligence firm Defused observed being exploited in the wild. ServiceNow has now applied patches to its own hosted instances and released hotfixes for partners and self-hosted customers. Organizations running self-managed deployments must therefore handle remediation themselves.
Self-assessment of severity scores
The three 10.0 scores were assigned by ServiceNow acting as a CVE Numbering Authority. Because NIST is currently limiting enrichment to vulnerabilities listed in CISA KEV or affecting federal systems, no independent verification of the ratings has occurred yet. ServiceNow reports no observed in-the-wild exploitation or public exploit code for the newly disclosed issues.
Immediate actions for security teams
Self-hosted customers should:
- Verify whether their ServiceNow instances are reachable from the internet or low-privilege network segments and restrict access where possible.
- Apply the corresponding Hot Fix releases for the affected branches (Xanadu, Yokohama, Zurich, Australia) without delay.
- Review configuration image upload logs, database query history, and unauthorized high-privilege activity.
- Add detection rules for anomalous GraphQL and ORDER BY injection patterns to WAF or IDS platforms.
The combination of three maximum-severity vulnerabilities and the platform’s central role in enterprise IT operations makes rapid patching essential.
Related articles
AI Agent Uncovers Unauthenticated Router Config Dump Leading to CVE Filing
An LLM agent tasked only with documenting network topology independently discovered a critical authentication bypass in a home router firmware. The agent performed read-only reconnaissance, extracted the full configuration including base64-encoded admin passwords and WPA2 keys via an unprotected CGI endpoint, and verified the finding by obtaining a valid session cookie. It then produced a complete coordinated disclosure report, classified the issue under CWE-306 with a CVSS 3.1 score of 8.8, and prepared the MITRE CVE submission package. The vulnerability affects LAN-side management interfaces of certain SOHO routers running legacy Boa web servers and remains unpatched due to inaccessible vendor firmware channels. The researcher maintained strict read-only permissions for the agent throughout the process, ensuring no configuration changes occurred. The case demonstrates how autonomous agents can accelerate vulnerability research while staying within defined operational boundaries.
AutoAddPolicy in Paramiko Disables Host Key Verification and Risks Credential Leakage After IP Reassignment
A developer discovered that fourteen deployment and management scripts all contained hardcoded references to a single VPS IP address. When the provider reassigned the address after migration, the scripts connected to an unrelated server belonging to another customer. The root cause was the line ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()), which silently accepts any host key instead of raising an exception. The connection succeeded, the root password stored in VPS_PASS was transmitted, and the operation appeared successful in logs. The author replaced AutoAddPolicy with RejectPolicy, centralized the address in a single vps.py module, and switched to key-based authentication with a password fallback. The same class of issue appears in web tools that fetch arbitrary URLs, requiring strict scheme, IP-range, and redirect checks to block SSRF vectors such as 127.0.0.1 and 169.254.169.254. The case demonstrates that host-key verification protects against routine cloud IP reuse rather than only theoretical man-in-the-middle attacks.
Developer Exposes 12 Vulnerabilities in FastAPI Todo App After 176 Bots Bypass Protections
A developer building a student-focused todo planner on FastAPI discovered that 176 of 238 new accounts were bots that bypassed three layers of protection including rate limiting and email verification. The issues stemmed from in-memory counters reset on every deployment, uvicorn trusting any X-Forwarded-For header, and email verification never being enforced in code. A full audit revealed additional flaws such as stored XSS via JSON-LD on public Q&A pages and an IDOR allowing any authenticated user to read all tasks in a project by supplying its ID. Fixes included moving rate limits to the database, properly extracting the client IP from the rightmost X-Forwarded-For entry, adding signed form timestamps, and escaping JSON for script contexts. The case highlights common pitfalls when deploying Python web services behind nginx without strict trust boundaries.
Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
A security researcher known as grizzzer detailed a full attack chain that resulted in defacing the authorization page of the First Partner Bank digital banking service inside the Standoff 365 online polygon. The demonstration began with a successful DNS zone transfer against the fpb.stf domain, revealing the dbo.fpb.stf host that hosted the target application. After identifying the Node.js, Express, and React stack, the researcher discovered that the receipt generation endpoint accepted an undocumented pretty parameter that was passed directly into the Pug template engine. This led to a server-side template injection vulnerability that was escalated to a Node.js reverse shell. With code execution, the attacker located and modified the translation.json localization file, replacing the welcome message with the string pwned by VON visible to all users. The write-up concludes with concrete hardening recommendations including disabling zone transfers, avoiding direct spread of req.query into templates, and restricting outbound connections.