ServiceNow Discloses Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Remote Code Execution and SQL Injection
ServiceNow AI platform has been hit with three CVSS 10.0 vulnerabilities that allow unauthenticated remote attackers to execute arbitrary code and SQL commands, putting global enterprise ITSM deployments at immediate risk.
Many organizations run their entire IT service desk, ticket workflows, asset management, and parts of automated operations on a single ServiceNow instance. An attacker gaining control of this central system obtains not only data but also the operational console for the company’s IT processes.
Three maximum-severity flaws
On August 27, ServiceNow published an advisory covering four vulnerabilities. The three rated CVSS 10.0 are:
- CVE-2026-18885 – Code injection in the GraphQL Composite Data API that permits unauthenticated attackers to run arbitrary code and read or modify instance data.
- CVE-2026-18886 – Access-control flaw in the system configuration image upload processor allowing unauthorized users to create or alter instance data and escalate privileges.
- CVE-2026-74820 – SQL injection triggered through the ORDER BY clause of dynamic schemas, enabling unauthenticated attackers to execute arbitrary SQL against the underlying database.
A fourth issue, CVE-2026-6876 (CVSS 8.7), concerns sandbox escape on the Now platform and also permits unauthenticated code execution.
All three 10.0 flaws share the same CVSS 4.0 attack vector: network-reachable, low complexity, no privileges, and no user interaction required, with high impact on confidentiality, integrity, and availability.
Why the disclosure is especially concerning
ServiceNow serves as the core ITSM platform for numerous large enterprises. Full compromise therefore grants attackers control over ticket handling, change management, CMDB assets, and security orchestration workflows.
The disclosure follows a July report of another pre-authentication sandbox escape (CVE-2026-6875) that threat intelligence firm Defused observed being exploited in the wild. ServiceNow has now applied patches to its own hosted instances and released hotfixes for partners and self-hosted customers. Organizations running self-managed deployments must therefore handle remediation themselves.
Self-assessment of severity scores
The three 10.0 scores were assigned by ServiceNow acting as a CVE Numbering Authority. Because NIST is currently limiting enrichment to vulnerabilities listed in CISA KEV or affecting federal systems, no independent verification of the ratings has occurred yet. ServiceNow reports no observed in-the-wild exploitation or public exploit code for the newly disclosed issues.
Immediate actions for security teams
Self-hosted customers should:
- Verify whether their ServiceNow instances are reachable from the internet or low-privilege network segments and restrict access where possible.
- Apply the corresponding Hot Fix releases for the affected branches (Xanadu, Yokohama, Zurich, Australia) without delay.
- Review configuration image upload logs, database query history, and unauthorized high-privilege activity.
- Add detection rules for anomalous GraphQL and ORDER BY injection patterns to WAF or IDS platforms.
The combination of three maximum-severity vulnerabilities and the platform’s central role in enterprise IT operations makes rapid patching essential.
Related articles
Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 Enable Unauthenticated Remote Code Execution
Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, both scoring CVSS 9.2, were disclosed on October 21. The flaws allow attackers to execute arbitrary code without authentication by triggering out-of-memory conditions that lead to use-after-free memory corruption. Exploitation involves specially crafted requests that manipulate uninitialized arrays and function pointers, with full chains demonstrated via PHP_SESSION_UPLOAD_PROGRESS and fatal error backtraces. The issues affect PHP versions starting from 5.4 and were discovered using AI tools Gemini 4 Argon and GPT-5.6 Sol, resulting in a patch exceeding 10,000 lines of code. Amazon detected attacks as early as October 17, with Cloudflare later reporting millions of exploitation attempts. Mitigation requires updating to patched versions such as PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, while temporary workarounds include disabling session upload progress and fatal error backtraces.
Trend Micro ZDI Reports on Critical Linux KSMBD Vulnerabilities Leak to Public Mailing Lists Before Patches
Trend Micro Zero Day Initiative inadvertently published detailed vulnerability reports for the Linux kernel's KSMBD component into public mailing lists. Two flaws received CVSS scores of 9.0, enabling remote code execution under specific conditions. One issue involves a race condition during parallel SMB request handling, while the second stems from an incorrect buffer size calculation in the SMB Direct mechanism that requires RDMA and a writable share. Technical details including root causes and reproduction steps became publicly archived before fixes reached end users. The KSMBD maintainer has already merged a patch for ZDI-CAN-33774 into their repository, yet distribution kernels may still lack the update. Additional privilege-escalation and information-disclosure risks in other kernel components were also described in the leaked messages.
Node.js Issues Security Releases for 26.x, 24.x and 22.x Fixing High-Severity TLS and Brotli Flaws
Node.js published security updates on October 21, 2026 for the 26.x, 24.x and 22.x release lines. The patches address multiple high-severity vulnerabilities affecting TLS hostname validation and the Brotli decoder, along with updates to critical dependencies including OpenSSL and Undici. Several CVEs cover bypasses in certificate hostname checks when IP addresses use full-width digits or when hosts resolve loosely to IP addresses. A particularly serious out-of-bounds write in the Brotli decoder (CVE-2026-111497) could enable remote code execution on services processing compressed responses. Additional fixes resolve keep-alive socket timing issues, DNS resolution truncation with NUL characters, and entropy caching problems in crypto.randomUUID and randomInt functions. The releases also update c-ares, Undici, OpenSSL, SQLite and ca-cert bundles following the eMudhra intermediate CA compromise.
Atlassian October Security Bulletin Flags 176 Third-Party Library Vulnerabilities Across Jira, Confluence and Bitbucket
Atlassian released its October security bulletin detailing 176 vulnerability entries distributed across seven products including Jira, Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible. Of these, 162 entries carry high severity and 14 are rated critical, though the total does not represent 176 unique flaws because the same identifiers recur when multiple products share the same third-party library. All critical issues originate in external components rather than Atlassian code, with the most severe being CVE-2026-65637 in the Coyote component of Apache Tomcat used by Confluence, which allows interception of server-client connections. Affected versions and corresponding fixes were published for Confluence Data Center, Bamboo, Bitbucket Data Center, Jira Software and Jira Service Management, with the company stressing that administrators must compare exact build numbers against the full corrected-version table. No exploitation of the listed issues had been reported as of 22 October, and Atlassian classifies the inherited exposure from third-party libraries as lower priority, issuing separate critical alerts only for immediate-risk cases.