VulnSocial

CVE-2026-18886Patch

MEDIUMCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-284

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 15 mentions across 6 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 12 signals
  • Technical details provided in 13 signals
  • Disclosure: 5 classified signals
  • General: 1 classified signal
  • Peaked 5d ago at 6 mentions (2026-08-28); latest day: 1
  • 15 total mentions across 6 days

Deep dive

Activity timeline15 mentions / 6d
02356Mentions · 2026-08-28: 6Mentions · 2026-08-29: 3Mentions · 2026-08-30: 2Mentions · 2026-08-31: 2Mentions · 2026-09-01: 1Mentions · 2026-09-03: 1Active Exploitation · 2026-08-31: 1Patch / Workaround · 2026-08-28: 4Patch / Workaround · 2026-08-29: 3Patch / Workaround · 2026-08-30: 2Patch / Workaround · 2026-08-31: 2Patch / Workaround · 2026-09-01: 1Technical Details · 2026-08-28: 5Technical Details · 2026-08-29: 3Technical Details · 2026-08-30: 1Technical Details · 2026-08-31: 2Technical Details · 2026-09-01: 1Technical Details · 2026-09-03: 108-2808-2908-3008-3109-0109-03
Signal classification4 categories
Patch
853.3%
Disclosure
533.3%
General
16.7%
Active Exploitation
16.7%
Referenced assets9 URLs
Classification over time
DateTotalLabels
2026-08-286
Disclosure2General1Patch3
2026-08-293
Disclosure1Patch2
2026-08-302
Disclosure1Patch1
2026-08-312
Active Exploitation1Patch1
2026-09-011
Patch1
2026-09-031
Disclosure1
Full discourse15 posts
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug. #ServiceNow #CodeInjection #SQLInjection #CVE #InfoSec https://securityonline.info/servicenow-code-injection-sql-injection/

    Post summary

    ServiceNow has issued patches for multiple high‑severity CVE‑2026 vulnerabilities that involve code injection and SQL injection, with the advisories noting CVSS scores of 10 and 8.7.

    04096883
    13.0K followersView on X
  • CyberTLDR@CyberTLDR
    Disclosure

    2/3 Three separate attack paths: CVE-2026-18885 injects code via the GraphQL API, CVE-2026-18886 lets anyone modify config and escalate privileges, and CVE-2026-74820 runs arbitrary SQL via an ORDER BY clause. Zero credentials needed. #ServiceNow #AppSec #ThreatIntel

    Post summary

    The post discloses three new ServiceNow CVEs, detailing their exploitation vectors and noting zero‑credential attack potential.

    1000065
    40 followersView on X
  • SOCRadar®@socradar
    Patch

    🚨 ServiceNow has patched four serious vulnerabilities — three rated a maximum CVSS 10.0 — affecting its AI Platform and related components. 🔹 CVE-2026-18885 – Code injection 🔹 CVE-2026-18886 – Improper access control 🔹 CVE-2026-74820 – SQL injection 🔹 CVE-2026-6876 – Sandbox escape No active exploitation has been reported so far, but teams running self-hosted or partner-managed environments should verify their patch status right away. Learn more: https://hubs.la/Q04vX-jN0 #CyberSecurity #ServiceNow #VulnerabilityManagement #PatchManagement

    Post summary

    ServiceNow has released patches for four high‑severity vulnerabilities (CVE‑2026‑18885, CVE‑2026‑18886, CVE‑2026‑74820, CVE‑2026‑6876), detailing the vulnerability types and urging affected teams to verify patch status. No active exploitation or PoC is reported.

    00010416
    6.6K followersView on X
  • Frontiera Tech@FrontieraTechIT
    Active Exploitation

    🛡️ CYBER BULLETIN | 2026/08/31 🚨 1. PaperCut NG/MF zero-days under active attack Attackers are chaining CVE-2026-81578 and CVE-2026-82078 for unauthenticated remote code execution on print servers. A second emergency patch is out after researchers found ways around the first fix. If the Application Server is internet-facing, isolate it and apply Release 2 immediately. 2. TerminalFix: fake Cloudflare CAPTCHAs open a reverse tunnel Microsoft detailed a new ClickFix variant that tricks users into pasting a command into Windows Terminal or PowerShell. The chain uses DLL sideloading and payloads hidden in PNG files to plant a Python reverse-tunnel backdoor. 3. ServiceNow patches three CVSS 10.0 flaws Unauthenticated attackers could inject code, escalate privileges, and run SQL on the ServiceNow AI Platform (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820). Treat this as an emergency patch window if you run ServiceNow. #Cybersecurity #CISA #NIST

    Post summary

    The bulletin states that PaperCut NG/MF and ServiceNow servers are the targets of ongoing attacks exploiting multiple CVEs, and it issues emergency patches and isolation guidance.

    1000098
    84 followersView on X
  • ActuX@ActuX_off
    Patch

    🚨 CYBERSÉCURITÉ — 3 FAILLES CRITIQUES CVSS 10.0 DANS SERVICENOW ServiceNow a publié le 27 août 2026 des correctifs pour plusieurs vulnérabilités majeures de sa plateforme AI, dont trois classées 10/10 : • CVE-2026-18885 : exécution de code arbitraire • CVE-2026-18886 : élévation de privilèges • CVE-2026-74820 : injection SQL permettant d’accéder ou modifier la base de données Dans certaines configurations, ces failles peuvent être exploitées à distance, sans authentification ni interaction de l’utilisateur. ServiceNow indique avoir déjà corrigé ses instances hébergées. En revanche, les entreprises utilisant des instances auto-hébergées doivent appliquer les mises à jour elles-mêmes sans délai. À ce stade du 29 août, ServiceNow affirme ne pas avoir identifié d’exploitation malveillante de ces nouvelles vulnérabilités. Source : ServiceNow / NHS England Digital #Cybersecurity #ServiceNow #CVE #Vulnerability #Infosec #CyberSecurity

    Post summary

    The post announces ServiceNow’s patches for three CVSS 10.0 vulnerabilities, details the types of flaws, and stresses that users with self‑hosted instances must apply the updates immediately, with no reported malicious exploitation yet.

    0001074
    218 followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: Multiple vulnerabilities in #ServiceNow. #CVE-2026-6876 #CVE-2026-18885 #CVE-2026-18886 #CVE-2026-74820 CVSS: 8.7 CVSS: 10 These vulnerabilities combined can lead to a full system compromise. Read our advisory: https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-servicenow-platforms-patch-immediately and #Patch #Patch #Patch

    Post summary

    The tweet warns of multiple high‑severity ServiceNow CVEs that could lead to full system compromise and urges users to patch immediately, referencing an advisory from ccb.belgium.be.

    00001398
    7.2K followersView on X
  • セキュリティ対策Lab@securityLab_jp
    Patch

    ServiceNow、CVSS 10.0の脆弱性3件を修正-未認証RCE・権限昇格・SQLインジェクションに対応(CVE-2026-18885,CVE-2026-18886,CVE-2026-74820) https://rocket-boys.co.jp/security-measures-lab/servicenow-cve-2026-18885-18886-74820/ #セキュリティ対策Lab #security #securitynews #セキュリティ #脆弱性

    Post summary

    The post announces that ServiceNow has released patches for three severe CVEs (CVSS 10.0) involving un‑authenticated RCE, privilege escalation, and SQL injection.

    00000142
    591 followersView on X
  • sea-are-pea@seaarepea
    Patch

    https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242 ServiceNow has remediated a SQL injection vulnerability a code injection vulnerability a sandbox escape security issue CVE-2026-6876, CVE-2026-18886, CVE-2026-74820 #ITSecurity

    Post summary

    ServiceNow has issued remediations for three vulnerabilities—SQL injection, code injection, and sandbox escape—covering CVE‑2026‑6876, CVE‑2026‑18886, and CVE‑2026‑74820.

    0000086
    72 followersView on X
  • Vistem Solutions@VistemSolutions
    Disclosure

    August 2026 CVE Advisory Notification - Security - Now Support Portal What you need to know: On August 27, 2026, ServiceNow issued CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 regarding the underlying logic that allowed for the reported security issues. If your organization uses ServiceNow, review the advisory, validate your instance status, apply recommended updates, and confirm access controls are properly configured. Staying secure starts with fast action and informed support. Need help assessing exposure or strengthening your cybersecurity posture? Vistem Solutions is here to help. 📩 sales@vistem.com #Cybersecurity #ServiceNow #CVE #SecurityAdvisory #VulnerabilityManagement #CyberResilience #VistemSolutions #SecureInnovation https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242&utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer

    Post summary

    ServiceNow released an advisory for CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, urging users to review the advisory and apply the recommended updates.

    0000055
    88 followersView on X
  • Alexius McMullin@McM1Alex
    Patch

    ServiceNow patched three CVSS 10.0 vulnerabilities August 28. All three: unauthenticated code injection or SQL injection in the AI Platform. CVE-2026-18885, CVE-2026-18886, CVE-2026-74820. Every internet-facing instance vulnerable until patched. #Cybersecurity

    Post summary

    ServiceNow has released patches for three critical CVSS 10.0 vulnerabilities affecting the AI Platform, and all internet-facing instances remain vulnerable until the updates are applied.

    0000068
    14 followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    🖼️ ServiceNow AI platform: CVE-2026-18886 is a CVSS 10 critical flaw. Unauthenticated attackers can escalate privileges via the System Configuration Image Upload Processor. No credentials needed. Patch now. #cybersecurity #ciso #cto #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-18886?utm_campaign=x https://t.co/E28N56ySxr

    Post summary

    A critical ServiceNow AI platform vulnerability (CVE-2026-18886) allows unauthenticated privilege escalation via the image upload processor; patching is urgently recommended.

    00000174
    882 followersView on X
  • RedLegg@RedLegg
    Disclosure

    Security Bulletin: Multiple Critical Vulnerabilities in ServiceNow AI Platform - Three critical ServiceNow AI Platform vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) may enable code injection, privilege escalation, or SQL inj... https://hubs.li/Q04vK_X50

    Post summary

    A security bulletin announces three critical ServiceNow AI Platform vulnerabilities capable of code injection, privilege escalation, or SQL injection, but no PoC, exploit code, or patch details are included.

    0000058
    2.2K followersView on X
  • The CyberSec Guru@thecybersecguru
    Disclosure

    🚨 ServiceNow just disclosed 3 CVSS 10.0 vulnerabilities that need immediate attention. No authentication. No user interaction. Low attack complexity. CVE-2026-18885 can enable arbitrary code execution. CVE-2026-18886 can enable privilege escalation. CVE-2026-74820 can enable arbitrary SQL execution against the underlying database. A fourth ServiceNow sandbox escape, CVE-2026-6876, is rated CVSS 8.7. If you operate ServiceNow, check your patch level now. Full breakdown + affected versions 👇 https://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/ #ServiceNow #CVE2026 #InfoSec #CyberSecurity

    Post summary

    ServiceNow has disclosed three CVSS 10.0 vulnerabilities—CVE‑2026‑18885, CVE‑2026‑18886, and CVE‑2026‑74820—detailing their exploitation vectors and urging immediate patching.

    0000088
    1.4K followersView on X
  • The CyberSec Guru@thecybersecguru
    Patch

    🚨 SERVICE NOW USERS: PATCH THIS NOW. 3 new CVSS 10.0 vulnerabilities could let unauthenticated attackers cross critical security boundaries: 🔴 CVE-2026-18885 — Code injection / arbitrary code execution 🔴 CVE-2026-18886 — Privilege escalation / data modification 🔴 CVE-2026-74820 — SQL injection / arbitrary SQL execution No credentials. No user interaction. Low attack complexity. This is a serious enterprise attack surface. Affected ServiceNow AI Platform environments should be checked and patched immediately. Full technical breakdown + affected versions 👇 https://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/ #ServiceNow #CyberSecurity #CVE #CVE2026 #RCE #SQLInjection #InfoSec #CyberAttack #Vulnerability

    Post summary

    The post alerts ServiceNow users to patch three newly disclosed CVSS 10.0 vulnerabilities—CVE‑2026‑18885, CVE‑2026‑18886, and CVE‑2026‑74820—providing technical details but no evidence of exploitation or PoC.

    00000129
    1.4K followersView on X
  • Autumn Good@autumn_good_35
    General

    🚨🚨🚨 CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, CVE-2026-74820 August 2026 CVE Advisory Notification - Security ServiceNow Posture https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242

    Post summary

    The post lists several CVE identifiers and provides a link to a ServiceNow advisory, but offers no specific details on exploits, PoC, or patches within the text itself.

    00000425
    7.0K followersView on X

Explore more

Back to dashboard