ServiceNow: Three CVSS 10.0 Flaws Including a GraphQL Injection — Self-Hosted Instances Must Patch Themselves

> TL;DR: ServiceNow's August 27, 2026 advisory fixes four flaws, three of them rated 10.0 — the maximum score. CVE-2026-18885 is a code injection in the GraphQL Composite Data API letting an unauthenticated user run arbitrary code and access instance data. CVE-2026-18886 is an access control failure in the system configuration image upload processor (unauthenticated privilege escalation). CVE-2026-74820 is SQL injection reached through a dynamic schema ORDER BY clause. A sandbox escape (CVE-2026-6876, CVSS 8.7) rounds it out. ServiceNow-hosted instances received the fix automatically; self-hosted and partner-managed instances must apply updates themselves.

The four flaws in detail

Affected versions cover the four recent release families: Xanadu (before Patch 11 Hot Fix 7a), Yokohama (before Patch 12 Hot Fix 3b and before Patch 13 Hot Fix 4), plus Zurich and Australia with their own hotfix lists. If you operate a self-hosted instance, reading the vendor advisory is the only way to know precisely where you stand.

The context: a platform already under tension

This advisory follows CVE-2026-6875, a pre-authentication sandbox escape published July 13 after a report from Searchlight Cyber. Days later, Defused announced in-the-wild exploitation — then corrected itself: the captured payload matched Searchlight's published PoC, not wild exploitation. ServiceNow confirmed it had "not observed evidence that this activity is related to instances that ServiceNow hosts."

An important prioritization detail: ServiceNow is its own CVE Numbering Authority (CNA), and since April 2026 NIST only enriches vulnerabilities in CISA's KEV catalog, those affecting federal software, or those designated critical. As of August 28, none of the four were in KEV — the 10.0 scores are the vendor's own, with no independent counter-assessment yet. That does not change technical severity; it changes how your prioritization tools will (mis)rank these CVEs.

Why this matters to you

ServiceNow is not just ITSM: it also runs HR service delivery (onboarding, leave requests, employee workflows) and internal catalogs in many large organizations. A compromised instance concentrates employee data, approval workflows, and integrations (AD connectors, SSO, webhooks into other SaaS). Unauthenticated GraphQL injection is precisely the flaw class an API surface audit looks for: a modern, exposed endpoint whose resolution layer executes more logic than its authorization model allows.

What to do

The broader lesson

Three 10.0 flaws in one release, all exploitable unauthenticated, across components as different as a GraphQL API, a configuration upload, and a SQL clause: this signals a platform-wide security review, not isolated fixes. For teams relying on SaaS infrastructure platforms (ITSM, HR service delivery, ESM), the core question stays the same: who audits the instance, its configuration, and its exposed endpoints — not just the vendor's software, but what you built with it.