Skip to main content

ServiceNow AI Platform CVE-2026-18886

| EUVDEUVD-2026-67220 CRITICAL
2026-08-27 SN GHSA-f8mv-7pgv-hmrg
Privilege Escalation Servicenow Ai Platform
10.0
CVSS 4.0 · Vendor: SN
Share

Severity by source

Vendor (SN) PRIMARY
10.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Vendor describes unauthenticated network exploitation (PR:N/AV:N/AC:L) creating/modifying instance data and escalating privileges, with impact crossing an authorization boundary (S:C) and full CIA impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (SN).

CVSS VectorVendor: SN

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 27, 2026 - 20:30 vuln.today
CVE Published
Aug 27, 2026 - 19:00 cve.org
CRITICAL 10.0

DescriptionCVE.org

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.

ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

AnalysisAI

Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to create or modify instance data beyond intended boundaries, resulting in privilege escalation. ServiceNow has patched hosted instances and supplied updates to partners and self-hosted customers; the vendor rates this maximum severity (CVSS 4.0 10.0) but reports no known exploitation. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach network-exposed ServiceNow instance
Delivery
Send crafted unauthenticated request
Exploit
Bypass missing access control check
Execution
Create or modify instance data
Impact
Escalate privileges on instance
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no user interaction, and no special attack requirements against a network-reachable instance. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems) scores a maximum 10.0, describing network-reachable, low-complexity, unauthenticated exploitation with system-wide impact - the strongest possible signal on paper. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A remote attacker with no credentials sends crafted requests to a network-reachable ServiceNow AI Platform instance and, exploiting the missing authorization check, creates or modifies instance data to grant themselves elevated privileges. From that foothold they could alter records, roles, or configuration across the instance. …
Remediation Patch available per vendor advisory: ServiceNow deployed a security update to hosted instances and provided the update to partners and self-hosted customers; a specific fixed version number was not included in the available data, so consult the ServiceNow KB article (https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242) for the exact patched release and apply it or upgrade to a patched release promptly. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: verify whether your organization operates ServiceNow cloud-hosted or self-hosted instances and confirm patch deployment status with your ServiceNow account team. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Servicenow Ai Platform

View all
CVE-2026-6875 CRITICAL POC
9.5 Jul 13

Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circ
CVE-2026-74820 CRITICAL
10.0 Aug 27

SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arb
CVE-2026-18885 CRITICAL
10.0 Aug 27

Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumst

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

CVE-2026-18886 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy