ServiceNow Discloses Three CVSS 10.0 Vulnerabilities Allowing Unauthenticated Remote Code Execution and SQL Injection
ServiceNow AI platform has been hit with three CVSS 10.0 vulnerabilities that allow unauthenticated remote attackers to execute arbitrary code and SQL commands, putting global enterprise ITSM deployments at immediate risk.
Many organizations run their entire IT service desk, ticket workflows, asset management, and parts of automated operations on a single ServiceNow instance. An attacker gaining control of this central system obtains not only data but also the operational console for the company’s IT processes.
Three maximum-severity flaws
On August 27, ServiceNow published an advisory covering four vulnerabilities. The three rated CVSS 10.0 are:
- CVE-2026-18885 – Code injection in the GraphQL Composite Data API that permits unauthenticated attackers to run arbitrary code and read or modify instance data.
- CVE-2026-18886 – Access-control flaw in the system configuration image upload processor allowing unauthorized users to create or alter instance data and escalate privileges.
- CVE-2026-74820 – SQL injection triggered through the ORDER BY clause of dynamic schemas, enabling unauthenticated attackers to execute arbitrary SQL against the underlying database.
A fourth issue, CVE-2026-6876 (CVSS 8.7), concerns sandbox escape on the Now platform and also permits unauthenticated code execution.
All three 10.0 flaws share the same CVSS 4.0 attack vector: network-reachable, low complexity, no privileges, and no user interaction required, with high impact on confidentiality, integrity, and availability.
Why the disclosure is especially concerning
ServiceNow serves as the core ITSM platform for numerous large enterprises. Full compromise therefore grants attackers control over ticket handling, change management, CMDB assets, and security orchestration workflows.
The disclosure follows a July report of another pre-authentication sandbox escape (CVE-2026-6875) that threat intelligence firm Defused observed being exploited in the wild. ServiceNow has now applied patches to its own hosted instances and released hotfixes for partners and self-hosted customers. Organizations running self-managed deployments must therefore handle remediation themselves.
Self-assessment of severity scores
The three 10.0 scores were assigned by ServiceNow acting as a CVE Numbering Authority. Because NIST is currently limiting enrichment to vulnerabilities listed in CISA KEV or affecting federal systems, no independent verification of the ratings has occurred yet. ServiceNow reports no observed in-the-wild exploitation or public exploit code for the newly disclosed issues.
Immediate actions for security teams
Self-hosted customers should:
- Verify whether their ServiceNow instances are reachable from the internet or low-privilege network segments and restrict access where possible.
- Apply the corresponding Hot Fix releases for the affected branches (Xanadu, Yokohama, Zurich, Australia) without delay.
- Review configuration image upload logs, database query history, and unauthorized high-privilege activity.
- Add detection rules for anomalous GraphQL and ORDER BY injection patterns to WAF or IDS platforms.
The combination of three maximum-severity vulnerabilities and the platform’s central role in enterprise IT operations makes rapid patching essential.
Related articles
Ghost Assets in Vulnerability Management: How Identification, Merging and Asset History Eliminate Anomalies in MaxPatrol VM
Positive Technologies experts explain how infrastructure changes create duplicate, merged and phantom assets that distort vulnerability management. The article details three core mechanisms inside MaxPatrol VM: unique asset identification across scan sources, non-destructive merging of new and existing data, and full lifecycle history with configurable aging policies. It describes how the system distinguishes assets using prioritized keys such as system ID, FQDN, MAC address and VM ID, then applies recursive merging rules that respect multiple data sources. Policies allow teams to set freshness and obsolescence thresholds, automatically hiding assets after 90 days while preserving historical snapshots for PDQL queries. The piece also covers practical cloning and partial-scan scenarios that can produce misleading duplicates or lingering collections.
GreyNoise Detects Active Exploitation Attempts of CVE-2021-36260 Against Hikvision Cameras
GreyNoise recorded exploitation attempts targeting CVE-2021-36260 in Hikvision cameras and recorders between September 21 and October 1. The vulnerability carries a CVSS score of 9.8 and allows unauthenticated remote command execution through insufficient input validation in the embedded web server. Attack traffic originated from four IP addresses, three routed through a commercial VPN in Lithuania and one from a Ukrainian residential network, with all targets located in Ukraine. Attackers leveraged a publicly available Nuclei template to probe devices, though GreyNoise confirmed only scanning activity and not successful compromises. The five-year-old flaw remains actively scanned despite an available firmware patch from Hikvision and a CISA advisory recommending immediate updates. Password changes provide no protection because the attack requires no authentication. Defenders are advised to apply firmware updates, remove devices from public internet exposure, and segment video surveillance networks from critical infrastructure.
Splunk Enterprise Discloses 46 Vulnerabilities Including Critical Patroni Authentication Flaw
Splunk has published three security advisories detailing a total of 46 vulnerabilities affecting Splunk Enterprise and related components. Three of the issues were rated critical, with CVE-2026-76268 receiving a CVSS v3.1 base score of 9.8. The flaw resides in the Patroni REST API used for PostgreSQL cluster management within search head clusters, allowing unauthenticated remote attackers to execute arbitrary operating system commands. Another high-severity issue, CVE-2026-76266, enables local privilege escalation to root on Linux systems during package updates. The remaining vulnerabilities cover product code, internally identified problems, and third-party packages. Organizations are urged to apply the available patches promptly.
Smart Fish Tank Power Strip Server Breached, Killing Aquarium Fish During National Day Holiday
During China's National Day holiday, the cloud servers of Woda Technology's smart power strips for fish tanks were compromised by malicious hackers, causing widespread remote disconnections and power outages for user devices. The attack left heating rods, oxygen pumps, and circulation systems offline for hours, resulting in the deaths of koi, arowana, and other ornamental fish that users had maintained for years. Woda issued a public notice confirming the intrusion was not a product defect or user error but a deliberate network attack, and the company has since upgraded firewalls, added multi-layer cloud protections, deployed backup servers, and improved local offline logic to prevent future failures. The incident highlights a critical IoT design flaw where devices rely entirely on vendor cloud platforms for control, allowing attackers who breach the server to remotely manage household appliances at scale. Security experts note that the same architecture is used across smart speakers, locks, cameras, and other consumer devices, creating a broad attack surface with minimal updates or segmentation. Woda has reported the case to authorities and preserved logs for forensic investigation.