ServiceNow Discloses Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Remote Code Execution and SQL Injection
ServiceNow AI platform has been hit with three CVSS 10.0 vulnerabilities that allow unauthenticated remote attackers to execute arbitrary code and SQL commands, putting global enterprise ITSM deployments at immediate risk.
Many organizations run their entire IT service desk, ticket workflows, asset management, and parts of automated operations on a single ServiceNow instance. An attacker gaining control of this central system obtains not only data but also the operational console for the company’s IT processes.
Three maximum-severity flaws
On August 27, ServiceNow published an advisory covering four vulnerabilities. The three rated CVSS 10.0 are:
- CVE-2026-18885 – Code injection in the GraphQL Composite Data API that permits unauthenticated attackers to run arbitrary code and read or modify instance data.
- CVE-2026-18886 – Access-control flaw in the system configuration image upload processor allowing unauthorized users to create or alter instance data and escalate privileges.
- CVE-2026-74820 – SQL injection triggered through the ORDER BY clause of dynamic schemas, enabling unauthenticated attackers to execute arbitrary SQL against the underlying database.
A fourth issue, CVE-2026-6876 (CVSS 8.7), concerns sandbox escape on the Now platform and also permits unauthenticated code execution.
All three 10.0 flaws share the same CVSS 4.0 attack vector: network-reachable, low complexity, no privileges, and no user interaction required, with high impact on confidentiality, integrity, and availability.
Why the disclosure is especially concerning
ServiceNow serves as the core ITSM platform for numerous large enterprises. Full compromise therefore grants attackers control over ticket handling, change management, CMDB assets, and security orchestration workflows.
The disclosure follows a July report of another pre-authentication sandbox escape (CVE-2026-6875) that threat intelligence firm Defused observed being exploited in the wild. ServiceNow has now applied patches to its own hosted instances and released hotfixes for partners and self-hosted customers. Organizations running self-managed deployments must therefore handle remediation themselves.
Self-assessment of severity scores
The three 10.0 scores were assigned by ServiceNow acting as a CVE Numbering Authority. Because NIST is currently limiting enrichment to vulnerabilities listed in CISA KEV or affecting federal systems, no independent verification of the ratings has occurred yet. ServiceNow reports no observed in-the-wild exploitation or public exploit code for the newly disclosed issues.
Immediate actions for security teams
Self-hosted customers should:
- Verify whether their ServiceNow instances are reachable from the internet or low-privilege network segments and restrict access where possible.
- Apply the corresponding Hot Fix releases for the affected branches (Xanadu, Yokohama, Zurich, Australia) without delay.
- Review configuration image upload logs, database query history, and unauthorized high-privilege activity.
- Add detection rules for anomalous GraphQL and ORDER BY injection patterns to WAF or IDS platforms.
The combination of three maximum-severity vulnerabilities and the platform’s central role in enterprise IT operations makes rapid patching essential.
Related articles
Telegram Voice Call Flaw Allows Remote Code Execution on Android Devices
Security researchers disclosed a vulnerability in Telegram for Android that enables remote code execution on a victim's device simply by answering a voice call. The attacker requires only a standard account, and the flaw was present in versions 8.6.2 through 12.10.3 released between March 2022 and September 2026. Telegram addressed the issue in version 12.10.4, released at the end of September 2026. The root cause lies in improper handling of the MediaState message exchanged during calls, specifically when processing rotation values and missing video state fields, leading to out-of-bounds memory reads. The same underlying fix was deployed earlier to shared call libraries, iOS, and desktop clients, but reached Android later. Researchers confirmed the impact only on private calls running on ARM64 Android devices, with no evidence of exploitation in the wild or public CVE assignment as of October 29, 2026.
360 Security Cloud Opens PHP2Shell Vulnerability Self-Check Platform to Government and Enterprise Users
360 Security Cloud has launched a dedicated self-assessment platform that allows organizations to scan their PHP-based websites and systems for the PHP2Shell vulnerability. The service is now available to government agencies, large enterprises, and small-to-medium businesses. Users can apply by scanning a provided QR code to determine how many of their assets run PHP, identify affected versions, and check whether any systems have already been compromised. The platform addresses key questions about exposure: the number of PHP-powered sites and systems, the presence of vulnerable versions, and signs of prior intrusion. The announcement emphasizes that the tool helps organizations proactively assess risk without requiring external assistance. The original Chinese report was published on October 30, 2026, and the service is positioned as a practical response to ongoing PHP-related security concerns.
Liferay Community Edition Misconfiguration Exposes Plaintext Passwords in Government Systems via CWE-319
A detailed analysis reveals how the use of Liferay Community Edition in a closed government information system led to the transmission of user passwords in plaintext through transactional emails. The issue stemmed from default notification templates that included the [$PASSWORD$] macro, combined with unadjusted system variables pointing to localhost instead of the production domain. Despite proper OAuth 2.0 delegation and CSRF protections, the misconfigured password change workflow sent permanent credentials in clear text to user inboxes. The root cause was traced to custom portlets that incorrectly reused the New Password Notification trigger intended only for administrator-initiated resets. Remediation involves removing the password macro from email templates and updating portal-ext.properties to enforce production host settings. The case highlights how open-source enterprise platforms require thorough hardening beyond initial code audits when deployed in high-security environments.
GitLab Critical Vulnerabilities Traced to Ruby Onigmo Regex Engine, Including Exploited CVE-2026-97229
GitLab has disclosed that four critical vulnerabilities, including the already-exploited CVE-2026-97229, originate from flaws in the Ruby programming language's Onigmo regular expression engine rather than in GitLab code itself. The most severe issue, CVE-2026-97229, is an integer overflow in regex processing within CI/CD configuration files and carries a maximum CVSSv3.1 base score of 10.0. GitLab released patches on October 8, 2026, covering versions 19.4.2, 19.3.5, and 19.2.8. Ruby's development team followed with its own advisory on October 23, 2026, addressing the same underlying defects. The remaining three vulnerabilities involve double-free memory errors and additional integer overflows during regex parsing and compilation. Because the root cause lies in a shared dependency, any application or environment relying on the affected Ruby Onigmo engine may also be exposed.