Three CVEs in ServiceNow's 27 August advisory share the same top score and the same shape: no password needed, no user interaction needed, reachable straight over the network. CVE-2026-18885 is a code injection flaw in the GraphQL Composite Data API that lets an unauthenticated attacker execute arbitrary code and read or modify instance data outright. CVE-2026-18886 is an improper access control bug in the system configuration image upload processor, letting an unauthenticated user create or modify data as a route to full privilege escalation. CVE-2026-74820 is SQL injection through a dynamic schema ORDER BY clause, letting an unauthenticated user run arbitrary SQL directly against the instance's underlying database. A fourth, lower but still serious flaw, CVE-2026-6876 (CVSS 8.7), is a sandbox escape in the Now Platform that also allows unauthenticated code execution. The Hacker News has the full technical breakdown of all four.
The line that's doing the most work
ServiceNow's advisory states it is not currently aware of any of the four being exploited. Taken alone, that's a reasonable and fairly standard thing for a vendor to say about a freshly patched batch. It reads differently next to CVE-2026-6876's close cousin, CVE-2026-6875, an earlier sandbox escape in the same platform area. Searchlight Cyber reported that flaw to ServiceNow back on 1 April 2026 and later published proof-of-concept code, and threat intelligence firm Defused says it observed CVE-2026-6875 being exploited in the wild in July - detailed in a separate Hacker News report from that month - before this week's advisory, and while the "not aware of exploitation" framing was still the operative public line on the platform's sandbox-escape flaws generally.
Why unauthenticated matters more here than usual
A CVSS 10.0 that needs no credentials is always worth attention, but on a platform like ServiceNow it's worth more than the score alone suggests. Instances typically hold IT service management records, HR case data, and increasingly the workflow and data connections behind agentic AI features - exactly the kind of cross-functional access an attacker would otherwise need multiple separate footholds to assemble. An unauthenticated SQL injection or code execution path into that instance skips the credential-theft step entirely, which is usually the slowest and most detectable part of an intrusion.
Hosted versus self-managed is the real fork in the road
ServiceNow says it has already applied the fix to its own hosted instances, and made the update available to partners and customers running self-hosted deployments. That split matters: a hosted customer's exposure window closed the moment ServiceNow's own rollout finished, largely without needing to do anything. A self-hosted or partner-managed instance's exposure window closes only when whoever operates that instance actually applies the patch - which is the same gap that let CVE-2026-6875 sit exploitable in July despite a fix being available - a version of the non-human identity and access exposure we've written about in our piece on non-human identity management for AI agents at scale, since a platform this deeply wired into automated workflows carries the same governance question either way.
- Confirm whether your ServiceNow instance is hosted or self-managed, and if self-managed, apply the 27 August patch for CVE-2026-18885, CVE-2026-18886, CVE-2026-74820 and CVE-2026-6876 immediately rather than assuming hosted-customer coverage applies.
- Review instance logs for the GraphQL Composite Data API, the system configuration image upload processor, and any unusual dynamic-schema query activity for signs of probing before the patch was applied.
- Treat "not currently aware of exploitation" as a snapshot, not a guarantee - CVE-2026-6875 shows that assessment can be wrong for weeks before anyone outside the platform vendor knows.
- Where ServiceNow feeds agentic AI workflows or connects to other systems, review what those integrations could reach if the instance itself were compromised, not just what's stored in it directly.
- Ask your account team directly whether any of the four CVEs in this advisory have shown exploitation signals since disclosure - vendor advisories update after publication more often than customers go back to re-read them.
A platform holding this much cross-functional data is worth a patching SLA measured in days, not the next change window. If you'd like help reviewing how quickly critical vendor patches actually land on your ServiceNow estate, email sales@halfteck.com.