---
title: "Three Maximum-Severity ServiceNow AI Platform Flaws Require a Patch Check"
description: "ServiceNow has patched three maximum-severity AI Platform vulnerabilities. The governance task is to verify hosted or self-hosted remediation and review the platform's connected authority."
url: https://artificiallyconfident.com/servicenow-ai-platform-critical-vulnerabilities-patch-check/
date: 2026-08-29
modified: 2026-08-29
author: "Andy"
image: https://artificiallyconfident.com/wp-content/uploads/2026/08/servicenow-ai-platform-critical-vulnerabilities-patch-check.png
categories: ["AI Risk and Security"]
type: post
lang: en-US
---

# Three Maximum-Severity ServiceNow AI Platform Flaws Require a Patch Check

ServiceNow disclosed four vulnerabilities on 27 August affecting its Now and AI platforms, including three that it rates at the maximum CVSS 10.0 severity. The most serious issues could, in certain circumstances, let an unauthenticated attacker execute code, escalate privileges or run SQL against an instance database. ServiceNow says it has patched hosted instances and supplied updates to partners and self-hosted customers.

**Evidence note — last checked 29 August 2026, 06:12 BST:** The immediate impact may be limited because ServiceNow says it is not aware of malicious exploitation and has already updated the instances it hosts. The operational lesson is material: organisations running self-hosted instances must verify their own patch state, while all customers should confirm what was changed, when it was applied and whether connected systems require follow-up review.

The disclosure covers [CVE-2026-18885](https://www.cve.org/CVERecord?id=CVE-2026-18885), a code-injection flaw; [CVE-2026-18886](https://www.cve.org/CVERecord?id=CVE-2026-18886), an access-control flaw that could enable privilege escalation; and [CVE-2026-74820](https://www.cve.org/CVERecord?id=CVE-2026-74820), a SQL-injection flaw. A fourth issue, [CVE-2026-6876](https://www.cve.org/CVERecord?id=CVE-2026-6876), is rated 8.7 and concerns a sandbox escape that could permit arbitrary code execution.

[NHS England’s cyber alert](https://digital.nhs.uk/cyber-alerts/2026/cc-4839) tells affected organisations to review ServiceNow advisory KB3152242 and apply the relevant updates as soon as possible. The [Canadian Centre for Cyber Security](https://www.cyber.gc.ca/en/alerts-advisories/servicenow-security-advisory-av26-857) has issued a parallel advisory identifying affected releases and directing administrators to the vendor’s update material.

## What is established

All three 10.0 vulnerabilities are described as network-reachable, low-complexity attacks requiring neither existing privileges nor user interaction. The potential effects extend beyond an isolated error: arbitrary code execution, unauthorised creation or modification of instance data, and direct database access can threaten confidentiality, integrity and availability.

The affected release families include Xanadu, Yokohama, Zurich and Australia, with the exact safe level depending on the branch. For example, Canada’s advisory identifies Xanadu releases before Patch 11 Hot Fix 7a and Yokohama releases before Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4. Zurich and Australia have several branch-specific fixed versions. Administrators should therefore use the vendor advisory rather than relying on a generic instruction to install “the latest patch”.

ServiceNow says the security update was deployed to hosted instances. That is important, but it should not be translated into a claim that every organisation is now safe. Self-hosted customers and partners received updates that they must apply. Even hosted customers may need to confirm the timing of remediation, review relevant logs and determine whether integrations, credentials or downstream records need examination under their own incident and supplier-assurance procedures.

There is currently no public evidence that these newly disclosed flaws have been exploited maliciously. [BleepingComputer’s reporting](https://www.bleepingcomputer.com/news/security/servicenow-warns-of-three-max-severity-security-vulnerabilities/) records ServiceNow’s statement that it is not aware of exploitation. [The Hacker News](https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html) found no public exploit code for the three maximum-severity issues as of 28 August and notes that the 10.0 scores are ServiceNow’s own assessment as the CVE Numbering Authority for its products.

## This is a platform-security story, not a rogue-AI story

The product name makes the disclosure relevant to AI governance, but the vulnerabilities are conventional software-security failures: injection, improper access control and sandbox escape. There is no evidence in the advisories that an AI model caused the flaws, discovered them autonomously or exploited them.

That distinction matters. Organisations increasingly describe orchestration platforms, workflow engines and enterprise data layers as “AI platforms”. The branding can obscure the fact that these systems still inherit the familiar attack surface of APIs, upload processors, databases, permissions and executable code. Adding agents or models does not replace established secure-development, patch-management and access-control disciplines. It increases the consequence when the platform can act across more connected systems.

The practical governance question is therefore not whether the underlying vulnerability is uniquely artificial intelligence. It is whether an AI-enabled operating layer has sufficient authority and connectivity to turn an ordinary platform compromise into a wider business event.

## The operational consequence

ServiceNow instances can sit close to identity, IT service management, security operations, customer service, employee workflows and other sensitive records. An organisation’s response should reflect the instance’s actual role, not just the severity score.

Teams should first establish whether they are hosted by ServiceNow, self-hosted or supported through a partner. They should then record the instance family, exact patch or hot-fix level, remediation timestamp and source of confirmation. Where the instance is self-hosted, the update should be treated as an urgent change with appropriate testing and evidence of completion.

Next, map what the instance can reach. Review privileged service accounts, integration users, secrets, data exports, database connections, automation routes and any AI agents authorised to trigger actions. Patch status answers whether the vulnerable code is still present; it does not answer whether suspicious activity occurred before remediation or whether a connected credential should be rotated.

Finally, preserve the decision trail. Record who assessed exposure, what evidence was used, what was patched, which logs were reviewed, whether retrospective investigation was required and who accepted any residual uncertainty. That follows the wider principle in our [analysis of AI-assisted vulnerability disclosure](https://artificiallyconfident.com/anthropic-ai-vulnerability-ledger-security-bottleneck/): a finding becomes a security outcome only when ownership, validation and deployment are visible. It also reflects why [AI governance needs decision logs](https://artificiallyconfident.com/ai-governance-needs-decision-logs-not-just-policies/) rather than a policy document alone.

## What to do and watch next

ServiceNow customers should review KB3152242 through their authorised support route, compare the instance against the branch-specific fixed release and retain proof of the result. Self-hosted operators should not assume that receiving an update means it has been installed. Hosted customers should obtain confirmation of the platform-side remediation and decide whether their own monitoring or integration review is proportionate to the instance’s authority and data.

The next material development would be evidence of exploitation, publication of proof-of-concept code, a change to affected-version guidance or further remediation instructions from ServiceNow or national cyber authorities. Until then, the responsible position is neither panic nor complacency: verify the patch, understand the connections and document the decision.

## Sources

- [ServiceNow: August 2026 CVE Advisory Notification, KB3152242](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242)
- [NHS England Digital: ServiceNow Now and AI Platform cyber alert](https://digital.nhs.uk/cyber-alerts/2026/cc-4839)
- [Canadian Centre for Cyber Security: ServiceNow advisory AV26-857](https://www.cyber.gc.ca/en/alerts-advisories/servicenow-security-advisory-av26-857)
- [The Hacker News: technical reporting and affected-version analysis](https://thehackernews.com/2026/08/three-cvss-100-servicenow-flaws-could.html)
- [BleepingComputer: independent reporting on the patches and exposure](https://www.bleepingcomputer.com/news/security/servicenow-warns-of-three-max-severity-security-vulnerabilities/)

*How we work: Artificially Confident articles are source-led, AI-assisted and editorially reviewed.*