Skip to main content

Now Platform EUVDEUVD-2026-67218

| CVE-2026-6876 CRITICAL
Code Injection (CWE-94)
2026-08-27 SN GHSA-7fw9-72q7-3g7j
RCE Code Injection Servicenow Now Platform
10.0
CVSS 4.0 · Vendor: SN
Share

Severity by source

Vendor (SN) PRIMARY
10.0 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
10.0 CRITICAL

Unauthenticated network RCE via sandbox escape with no user interaction; sandbox-to-platform breakout is a scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (SN).

CVSS VectorVendor: SN

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

6
Analysis Updated
Sep 01, 2026 - 19:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Sep 01, 2026 - 19:22 vuln.today
cvss_changed
Severity Changed
Sep 01, 2026 - 19:22 NVD
HIGH CRITICAL
CVSS changed
Sep 01, 2026 - 19:22 NVD
8.7 (HIGH) 10.0 (CRITICAL)
Analysis Generated
Aug 27, 2026 - 20:39 vuln.today
CVE Published
Aug 27, 2026 - 18:46 cve.org
HIGH 8.7

DescriptionCVE.org

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.

ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

AnalysisAI

Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting sandbox and execute arbitrary code, gaining more access to the instance than intended. ServiceNow rates this maximum severity (CVSS 4.0 base 10.0) and has patched hosted instances while shipping fixes to self-hosted and partner deployments across the Zurich, Australia, Xanadu, and Yokohama release families. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) indicates no special conditions - remote unauthenticated exploitation against network-reachable Now Platform instances with no user interaction or authentication required, per ServiceNow's own scoring. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with total confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems, and SSVC scores Technical Impact as 'total'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the ServiceNow-released patch for your instance's release family - the specific fixed builds are Yokohama Patch 13 Hot Fix 4, Xanadu Patch 11 Hot Fix 7a, Australia Patch 5 (or the relevant earlier hot fixes), and Zurich Patch 12 (or the applicable Zurich hot fix) - as documented in ServiceNow KB3152242 (https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify whether your ServiceNow instance is hosted or self-managed, and contact ServiceNow support for patch status specific to your release family (Zurich, Australia, Xanadu, or Yokohama). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Servicenow

View all
CVE-2026-6875 CRITICAL POC
9.5 Jul 13

Remote code execution in the ServiceNow AI Platform allows an unauthenticated attacker, under certain (unspecified) circ
CVE-2024-4879 CRITICAL POC
9.3 Jul 10

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platfo
CVE-2024-5217 CRITICAL POC
9.2 Jul 10

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earl
CVE-2018-7748 HIGH POC
8.8 Aug 03

report_viewer.do in ServiceNow Release Jakarta Patch 8 and earlier allows remote attackers to execute arbitrary code via
CVE-2022-38463 MEDIUM POC
6.1 Aug 23

ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Rated medium severit
CVE-2026-18885 CRITICAL
10.0 Aug 27

Remote code execution in the ServiceNow AI Platform lets an unauthenticated attacker, under certain unspecified circumst
CVE-2026-18886 CRITICAL
10.0 Aug 27

Improper access control in the ServiceNow AI Platform allows an unauthenticated user, under certain circumstances, to cr
CVE-2026-74820 CRITICAL
10.0 Aug 27

SQL injection in the ServiceNow AI Platform allows an unauthenticated attacker, under certain conditions, to execute arb
CVE-2025-12420 CRITICAL
9.8 Jan 12

ServiceNow AI Platform has a user impersonation vulnerability allowing unauthenticated attackers to impersonate any user
CVE-2024-8923 CRITICAL
9.3 Oct 29

ServiceNow has addressed an input validation vulnerability that was identified in the Now Platform. Rated critical sever
CVE-2024-8924 HIGH
8.7 Oct 29

ServiceNow has addressed a blind SQL injection vulnerability that was identified in the Now Platform. Rated high severit
CVE-2023-1298 MEDIUM
6.1 Jul 06

ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was

Same weakness CWE-94 – Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

EUVD-2026-67218 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy