CVE-2026-74820Patch

MEDIUMCVSS 10.0 · CRITICAL

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242

Weakness type (CWE)

CWE-89

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
16 mentions across 7 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 13 signals
Technical details provided in 14 signals
General: 2 classified signals
Disclosure: 1 classified signal
Peaked 5d ago at 6 mentions (2026-08-28); latest day: 1
16 total mentions across 7 days

Deep dive

Activity timeline16 mentions / 7d

Signal classification4 categories

Patch

1275.0%

General

212.5%

Disclosure

16.3%

Active Exploitation

16.3%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-27	1	Patch1
2026-08-28	6	Disclosure1General1Patch4
2026-08-29	3	Patch3
2026-08-30	2	Patch2
2026-08-31	2	Active Exploitation1Patch1
2026-09-01	1	Patch1
2026-09-03	1	General1

Full discourse16 posts

Daily CyberSecurity@Daily_CyberSec46d
Patch
ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug. #ServiceNow #CodeInjection #SQLInjection #CVE #InfoSec https://securityonline.info/servicenow-code-injection-sql-injection/
Post summary
The message announces that ServiceNow has released patches for several high‑score code and SQL injection vulnerabilities (CVE‑2026‑18885, CVE‑2026‑18886, CVE‑2026‑74820). No active exploitation or PoC is mentioned.
04096883
13.0K followersView on X
CyberTLDR@CyberTLDR40d
General
2/3 Three separate attack paths: CVE-2026-18885 injects code via the GraphQL API, CVE-2026-18886 lets anyone modify config and escalate privileges, and CVE-2026-74820 runs arbitrary SQL via an ORDER BY clause. Zero credentials needed. #ServiceNow #AppSec #ThreatIntel
Post summary
Three CVEs are mentioned with detailed attack paths, but no PoC, exploit code, active exploitation claim, or patch information is provided.
1000065
40 followersView on X
SOCRadar®@socradar42d
Patch
🚨 ServiceNow has patched four serious vulnerabilities — three rated a maximum CVSS 10.0 — affecting its AI Platform and related components. 🔹 CVE-2026-18885 – Code injection 🔹 CVE-2026-18886 – Improper access control 🔹 CVE-2026-74820 – SQL injection 🔹 CVE-2026-6876 – Sandbox escape No active exploitation has been reported so far, but teams running self-hosted or partner-managed environments should verify their patch status right away. Learn more: https://hubs.la/Q04vX-jN0 #CyberSecurity #ServiceNow #VulnerabilityManagement #PatchManagement
Post summary
ServiceNow has released patches for four high‑severity vulnerabilities and urges users to confirm their systems are updated; no exploitation has been reported.
00010416
6.6K followersView on X
Frontiera Tech@FrontieraTechIT42d
Active Exploitation
🛡️ CYBER BULLETIN | 2026/08/31 🚨 1. PaperCut NG/MF zero-days under active attack Attackers are chaining CVE-2026-81578 and CVE-2026-82078 for unauthenticated remote code execution on print servers. A second emergency patch is out after researchers found ways around the first fix. If the Application Server is internet-facing, isolate it and apply Release 2 immediately. 2. TerminalFix: fake Cloudflare CAPTCHAs open a reverse tunnel Microsoft detailed a new ClickFix variant that tricks users into pasting a command into Windows Terminal or PowerShell. The chain uses DLL sideloading and payloads hidden in PNG files to plant a Python reverse-tunnel backdoor. 3. ServiceNow patches three CVSS 10.0 flaws Unauthenticated attackers could inject code, escalate privileges, and run SQL on the ServiceNow AI Platform (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820). Treat this as an emergency patch window if you run ServiceNow. #Cybersecurity #CISA #NIST
Post summary
Multiple zero‑days (CVE‑2026‑81578/82078) against PaperCut NG/MF are actively exploited; a second emergency patch has been released, and urgent mitigation is recommended. Additionally, a new Windows exploit chain via fake CAPTCHAs and emergency patches for ServiceNow CVEs are highlighted.
1000098
84 followersView on X
ActuX@ActuX_off44d
Patch
🚨 CYBERSÉCURITÉ — 3 FAILLES CRITIQUES CVSS 10.0 DANS SERVICENOW ServiceNow a publié le 27 août 2026 des correctifs pour plusieurs vulnérabilités majeures de sa plateforme AI, dont trois classées 10/10 : • CVE-2026-18885 : exécution de code arbitraire • CVE-2026-18886 : élévation de privilèges • CVE-2026-74820 : injection SQL permettant d’accéder ou modifier la base de données Dans certaines configurations, ces failles peuvent être exploitées à distance, sans authentification ni interaction de l’utilisateur. ServiceNow indique avoir déjà corrigé ses instances hébergées. En revanche, les entreprises utilisant des instances auto-hébergées doivent appliquer les mises à jour elles-mêmes sans délai. À ce stade du 29 août, ServiceNow affirme ne pas avoir identifié d’exploitation malveillante de ces nouvelles vulnérabilités. Source : ServiceNow / NHS England Digital #Cybersecurity #ServiceNow #CVE #Vulnerability #Infosec #CyberSecurity
Post summary
ServiceNow released critical patches for three CVE‑#s (arbitrary code execution, privilege escalation, and SQL injection) with no evidence of active exploitation yet.
0001074
218 followersView on X
CCB Alert@CCBalert45d
Patch
Warning: Multiple vulnerabilities in #ServiceNow. #CVE-2026-6876 #CVE-2026-18885 #CVE-2026-18886 #CVE-2026-74820 CVSS: 8.7 CVSS: 10 These vulnerabilities combined can lead to a full system compromise. Read our advisory: https://ccb.belgium.be/advisories/warning-critical-vulnerabilities-servicenow-platforms-patch-immediately and #Patch #Patch #Patch
Post summary
The advisory warns of critical ServiceNow vulnerabilities with high CVSS scores and urges immediate patching via the provided link.
00001398
7.2K followersView on X
Upwind Security MDR@UpwindMDR46d
Patch
🚨Critical - ServiceNow AI Platform Unauth SQL Injection (CVE-2026-74820) ServiceNow AI Platform contains an unauthenticated SQL injection that, in certain circumstances, lets an attacker send crafted requests to execute arbitrary SQL against the instance’s underlying database. Impact: read/modify instance data beyond intended permissions. 👉Affected: ServiceNow AI Platform | Upgrade to a patched release - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
Post summary
Critical unauthenticated SQL injection discovered in ServiceNow AI Platform (CVE‑2026‑74820), with a patched release available via the provided ServiceNow support article.
0001096
297 followersView on X
セキュリティ対策Lab@securityLab_jp42d
Patch
ServiceNow、CVSS 10.0の脆弱性3件を修正-未認証RCE・権限昇格・SQLインジェクションに対応(CVE-2026-18885,CVE-2026-18886,CVE-2026-74820) https://rocket-boys.co.jp/security-measures-lab/servicenow-cve-2026-18885-18886-74820/ #セキュリティ対策Lab #security #securitynews #セキュリティ #脆弱性
Post summary
The article reports that ServiceNow has fixed three CVSS 10.0 vulnerabilities—CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820—covering unauthenticated RCE, privilege escalation, and SQL injection, and references a patch and remediation details.
00000142
591 followersView on X
sea-are-pea@seaarepea43d
Patch
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242 ServiceNow has remediated a SQL injection vulnerability a code injection vulnerability a sandbox escape security issue CVE-2026-6876, CVE-2026-18886, CVE-2026-74820 #ITSecurity
Post summary
ServiceNow has released patches that remediate three vulnerabilities—SQL injection, code injection, and sandbox escape—identified by CVE‑2026‑6876, CVE‑2026‑18886, and CVE‑2026‑74820.
0000086
72 followersView on X
Vistem Solutions@VistemSolutions44d
Patch
August 2026 CVE Advisory Notification - Security - Now Support Portal What you need to know: On August 27, 2026, ServiceNow issued CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 regarding the underlying logic that allowed for the reported security issues. If your organization uses ServiceNow, review the advisory, validate your instance status, apply recommended updates, and confirm access controls are properly configured. Staying secure starts with fast action and informed support. Need help assessing exposure or strengthening your cybersecurity posture? Vistem Solutions is here to help. 📩 sales@vistem.com #Cybersecurity #ServiceNow #CVE #SecurityAdvisory #VulnerabilityManagement #CyberResilience #VistemSolutions #SecureInnovation https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242&utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer
Post summary
ServiceNow released an advisory for CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, recommending that users review the advisory, validate their instances, and apply the available updates.
0000055
88 followersView on X
Alexius McMullin@McM1Alex44d
Patch
ServiceNow patched three CVSS 10.0 vulnerabilities August 28. All three: unauthenticated code injection or SQL injection in the AI Platform. CVE-2026-18885, CVE-2026-18886, CVE-2026-74820. Every internet-facing instance vulnerable until patched. #Cybersecurity
Post summary
ServiceNow released patches for three high‑score CVE vulnerabilities in its AI Platform, requiring all internet‑facing instances to be updated to avoid unauthenticated code or SQL injection attacks.
0000068
14 followersView on X
SecAlerts@SecAlertsCo44d
Patch
💉 ServiceNow patches CVE-2026-74820 — CVSS 10 SQLi via dynamic schema ORDER BY clause, no auth required. Part of three max-severity fixes. Patch now. #cybersecurity #ciso #cto #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-74820?utm_campaign=x https://t.co/DIbbnZihuc
Post summary
The tweet announces that ServiceNow has issued a patch for CVE-2026-74820, a high‑severity SQL injection vulnerability that requires no authentication and stresses applying the fix immediately.
00000144
882 followersView on X
RedLegg@RedLegg45d
Disclosure
Security Bulletin: Multiple Critical Vulnerabilities in ServiceNow AI Platform - Three critical ServiceNow AI Platform vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) may enable code injection, privilege escalation, or SQL inj... https://hubs.li/Q04vK_X50
Post summary
The bulletin announces three critical ServiceNow AI Platform vulnerabilities that could allow code injection, privilege escalation, or SQL injection.
0000058
2.2K followersView on X
The CyberSec Guru@thecybersecguru45d
Patch
🚨 ServiceNow just disclosed 3 CVSS 10.0 vulnerabilities that need immediate attention. No authentication. No user interaction. Low attack complexity. CVE-2026-18885 can enable arbitrary code execution. CVE-2026-18886 can enable privilege escalation. CVE-2026-74820 can enable arbitrary SQL execution against the underlying database. A fourth ServiceNow sandbox escape, CVE-2026-6876, is rated CVSS 8.7. If you operate ServiceNow, check your patch level now. Full breakdown + affected versions 👇 https://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/ #ServiceNow #CVE2026 #InfoSec #CyberSecurity
Post summary
The tweet announces three high‑severity ServiceNow vulnerabilities (CVE‑2026‑18885, CVE‑2026‑18886, and CVE‑2026‑74820) and urges users to patch immediately, providing a link for further details.
0000088
1.4K followersView on X
The CyberSec Guru@thecybersecguru45d
Patch
🚨 SERVICE NOW USERS: PATCH THIS NOW. 3 new CVSS 10.0 vulnerabilities could let unauthenticated attackers cross critical security boundaries: 🔴 CVE-2026-18885 — Code injection / arbitrary code execution 🔴 CVE-2026-18886 — Privilege escalation / data modification 🔴 CVE-2026-74820 — SQL injection / arbitrary SQL execution No credentials. No user interaction. Low attack complexity. This is a serious enterprise attack surface. Affected ServiceNow AI Platform environments should be checked and patched immediately. Full technical breakdown + affected versions 👇 https://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/ #ServiceNow #CyberSecurity #CVE #CVE2026 #RCE #SQLInjection #InfoSec #CyberAttack #Vulnerability
Post summary
The post announces three critical CVEs for ServiceNow, emphasizes urgent patching, and provides technical details and a link for further reference.
00000129
1.4K followersView on X
Autumn Good@autumn_good_3545d
General
🚨🚨🚨 CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, CVE-2026-74820 August 2026 CVE Advisory Notification - Security ServiceNow Posture https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
Post summary
The post lists several CVE identifiers and points to a ServiceNow KB article, but provides no specifics about the vulnerabilities, exploitation, or mitigation.
00000425
7.0K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-74820

SOCRadar®[verified]@socradarPatch

ServiceNow has released patches for four high‑severity vulnerabilities and urges users to confirm their systems are updated; no exploitation has been reported.

Frontiera Tech[verified]@FrontieraTechITActive Exploitation

Multiple zero‑days (CVE‑2026‑81578/82078) against PaperCut NG/MF are actively exploited; a second emergency patch has been released, and urgent mitigation is recommended. Additionally, a new Windows exploit chain via fake CAPTCHAs and emergency patches for ServiceNow CVEs are highlighted.

ActuX[verified]@ActuX_offPatch

ServiceNow released critical patches for three CVE‑#s (arbitrary code execution, privilege escalation, and SQL injection) with no evidence of active exploitation yet.

Upwind Security MDR[verified]@UpwindMDRPatch

Critical unauthenticated SQL injection discovered in ServiceNow AI Platform (CVE‑2026‑74820), with a patched release available via the provided ServiceNow support article.

セキュリティ対策Lab[verified]@securityLab_jpPatch

The article reports that ServiceNow has fixed three CVSS 10.0 vulnerabilities—CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820—covering unauthenticated RCE, privilege escalation, and SQL injection, and references a patch and remediation details.

sea-are-pea[verified]@seaarepeaPatch

ServiceNow has released patches that remediate three vulnerabilities—SQL injection, code injection, and sandbox escape—identified by CVE‑2026‑6876, CVE‑2026‑18886, and CVE‑2026‑74820.

Vistem Solutions[verified]@VistemSolutionsPatch

ServiceNow released an advisory for CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, recommending that users review the advisory, validate their instances, and apply the available updates.

The CyberSec Guru[verified]@thecybersecguruPatch

The tweet announces three high‑severity ServiceNow vulnerabilities (CVE‑2026‑18885, CVE‑2026‑18886, and CVE‑2026‑74820) and urges users to patch immediately, providing a link for further details.