ServiceNow has announced patches for four vulnerabilities, including three critical code injection flaws in the ServiceNow AI platform, each with a maximum severity (CVSS score of 10/10).
The first of the critical bugs, tracked as CVE-2026-18885, allows an attacker to execute arbitrary code in the ServiceNow platform under certain circumstances.
An attacker could exploit the weakness to gain access to and potentially modify arbitrary data, ServiceNow notes in its advisory.
The second critical defect, CVE-2026-18886, is described as an improper access control issue. It could allow an attacker to create or modify arbitrary data and elevate their privileges.
Tracked as CVE-2026-74820, the third critical vulnerability is an SQL injection flaw that allows an attacker to execute arbitrary SQL statements against the underlying ServiceNow database.
