August 2026 CVE Advisory Notification - Security

August 2026 CVE Advisory Notification  ServiceNow Posture August, 2026 Quick Summary What you need to know:

On August 27, 2026, ServiceNow issued CVE-2026-6876, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 regarding the underlying logic that allowed for the reported security issues.

Each of these security issues was identified through ServiceNow's security research and responsible disclosure programs and remediated independently. For security issues identified through responsible disclosure, researchers may publish their findings publicly.

Background CVE-2026-6876 -

Based on the CVSS v4.0 calculator, we have assessed the risk posed by the vulnerability addressed in CVE-2026-6876 to be high.

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.

CVE-2026-18885 -

Based on the CVSS v4.0 calculator, we have assessed the risk posed by the vulnerability addressed in CVE-2026-18885 to be critical.

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary code in the ServiceNow platform and gain access to, or modify, instance data beyond what was intended.

CVE-2026-18886 -

Based on the CVSS v4.0 calculator, we have assessed the risk posed by the vulnerability addressed in CVE-2026-18886 to be critical.

ServiceNow has remediated a code injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.

CVE-2026-74820 -

Based on the CVSS v4.0 calculator, we have assessed the risk posed by the vulnerability addressed in CVE-2026-74820 to be critical.

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.

Am I Affected? Customers who participate in the ServiceNow Patching Program received the appropriate update. We encourage customers to verify by comparing their instance version to the table below.

Release Version Updated Xanadu

Patch 11 Hot Fix 7a

Yokohama

Yokohama Patch 12 Hot Fix 3b

Yokohama Patch 13 Hot Fix 4

Zurich

Zurich Patch 7b Hot Fix 3

Zurich Patch 8 Hot Fix 5

Zurich Patch 9 Hot Fix 6

Zurich Patch 10 Hot Fix 2m (m-branch)

Zurich Patch 10 Hot Fix 3 (standard)

Zurich Patch 11

Zurich Patch 12

Australia

Australia Patch 2 Hot Fix 3

Australia Patch 3 Hot Fix 2

Australia Patch 3m

Australia Patch 4

Australia Patch 5

Customer Action Required Please see the instructions in the previous section to determine if your instance is on the appropriate version. We recommend self-hosted customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Additional Resources KB3152244 – [Requires Now Support Login] August 2026 CVE Advisory Notification KB3152251 – [Requires Now Support Login] Self-Hosted August 2026 CVE Advisory Notification KB3027795 - [Requires Now Support Login] ServiceNow Policy on Publishing Common Vulnerabilities and Exposures (CVE) https://www.cve.org/CVERecord?id=CVE-2026-6876 https://www.cve.org/CVERecord?id=CVE-2026-18885 https://www.cve.org/CVERecord?id=CVE-2026-18886 https://www.cve.org/CVERecord?id=CVE-2026-74820

Change Log Version Published Summary of Changes 1.0 August 27, 2026 Initial publication