CVE-2026-18885

criticalpriority · track · 3EPSS 0.072 · 94 %ileDE

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

7.24% (94th) EPSS

CVSS 10 · critical

Is it mine?

4 products

Check your exposure

Who says so?

1 sources

cert_bund

EPSS · scored 2026-10-23

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

cvss

Technical severity, 0–10. One row per scoring source.

10.0

010

base score 0–10 · higher = more severe · hover a vector to decode

v4.010criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · psirt@servicenow.com

v4.09.1criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-94US

affected products (4)

Products and version ranges known to be affected.

ServiceNow AI Platform Australiaall versionscert_bundDEcpe:/a:servicenow:ai_platform:australia
ServiceNow AI Platform Xanaduall versionscert_bundDEcpe:/a:servicenow:ai_platform:xanadu
ServiceNow AI Platform Yokohama all versionscert_bundDEcpe:/a:servicenow:ai_platform:yokohama
ServiceNow AI Platform Zurichall versionscert_bundDEcpe:/a:servicenow:ai_platform:zurich

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3060ServiceNow Now Platform und AI Platform: Mehrere SchwachstellenDeutsch2026-08-27csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in ServiceNow Now Platform und ServiceNow AI Platform ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen oder SQL-Injection-Angriffe durchzuführen.

sources

Which sources assert this record, and when.

cert_bund NVD CVE.org MITRE

published 2026-08-27modified 2026-09-01

references (1) nvd

External citations — patches, advisories, analysis.

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan