ServiceNow Patches Critical Vulnerabilities in AI Platform

ServiceNow has addressed three maximum-severity vulnerabilities in its AI Platform, which could allow unauthenticated attackers to execute code, perform SQL injection, and escalate privileges. The vulnerabilities, tracked as CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, were published on August 27, 2026. These flaws can be exploited without user interaction, making them particularly dangerous. ServiceNow has released patches for affected cloud-based instances and urged self-hosted customers to update immediately. The company reported no known exploitation of these vulnerabilities at this time. The vulnerabilities are critical due to their severity and accessibility, posing a significant risk to enterprise data. Additionally, a high-severity sandbox escape vulnerability, CVE-2026-6876, was also patched. Security experts emphasize the urgency for organizations to act quickly to mitigate potential risks.

Key Points: • Three critical vulnerabilities in ServiceNow's AI Platform require immediate patching. • Exploitation can occur without user interaction, increasing the risk for enterprises. • ServiceNow has not reported any known exploitation of these vulnerabilities.