ServiceNow AI Platform CVE-2026-18886

The CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates no authentication, no user interaction, and no special attack requirements against a network-reachable instance. However, the vendor description explicitly limits this to 'certain circumstances,' meaning exploitation is not confirmed against every default deployment and some unspecified instance state or configuration condition is required - the advisory does not name that condition publicly. The exploitable operation is the creation or modification of ServiceNow instance data leading to privilege escalation. Limiting factors: the instance must be network-reachable to the attacker, the unspecified qualifying 'circumstances' must hold, and ServiceNow-hosted instances have already been remediated, so remaining exposure is concentrated in unpatched self-hosted or partner-managed deployments.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems) scores a maximum 10.0, describing network-reachable, low-complexity, unauthenticated exploitation with system-wide impact - the strongest possible signal on paper. Countervailing signals temper this: ServiceNow explicitly states it is not currently aware of exploitation, so this is not on the CISA KEV list, no public POC or exploit code is identified, and no EPSS score was provided. The description also qualifies exploitation with 'in certain circumstances,' implying the theoretical 10.0 may require conditions not spelled out publicly, so the real-world attack surface may be narrower than the vector alone suggests. Even so, an unauthenticated, network-facing privilege-escalation flaw in a widely deployed enterprise SaaS platform warrants urgent patching for any exposed or self-hosted instance regardless of the absence of in-the-wild reports, since disclosure plus a maximum score tends to draw attacker attention quickly.

A remote attacker with no credentials sends crafted requests to a network-reachable ServiceNow AI Platform instance and, exploiting the missing authorization check, creates or modifies instance data to grant themselves elevated privileges. From that foothold they could alter records, roles, or configuration across the instance. No public POC exists at time of analysis, and the low attack complexity (AC:L) means exploitation would require no special timing or race conditions if the qualifying circumstances are met.