ServiceNow disclosed four vulnerabilities on 27 August 2026 and rated three of them CVSS 10.0: CVE-2026-18885, a code injection issue in the GraphQL Composite Data API, CVE-2026-18886, an improper access control issue in the system configuration image upload processor, and CVE-2026-74820, a SQL injection reached through a dynamic schema ORDER BY clause.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source 3 Security Online 2026-08-27 Unauthenticated remote code execution in the GraphQL Composite Data API, privilege escalation via the image upload processor, unauthenticated SQL injection via a dynamic schema ORDER BY clause, and a sandbox escape; none recorded as exploited; fixes shipped as Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b and later builds. Open source Three of the four sit in the AI Platform, the foundation layer on which ServiceNow builds its agent based AI functionality, which is the part of the stack enterprises spent the past two years wiring into their ticketing, HR and change management workflows.2 Techzine 2026-08-28 Three of the four CVEs affect the AI Platform, the foundation layer supporting ServiceNow agent based AI functionality; CVE-2026-6876 is a Now Platform sandbox escape; patching program customers were updated automatically while self hosted customers must apply updates themselves. Open source We assess with moderate confidence that the security debt now accumulating in enterprise agent platforms is concentrated in the plumbing beneath the models rather than in the models themselves, and that the industry's attention to model level evaluation is not matched by scrutiny of the APIs those agents call.
What was actually broken
The three maximum severity issues share the same profile, which is what pushes them to a perfect score. Each is reachable over the network, needs low attack complexity, requires no privileges and no user interaction, and carries high impact to confidentiality, integrity and availability at once.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source In plain terms: an attacker who can reach the instance can, per the vendor's own descriptions, execute arbitrary code inside the platform, create or alter instance data outside expected authorization limits, and run arbitrary SQL against the underlying database.4 Cyber Security News 2026-08-27 CVE-2026-18885 and CVE-2026-18886 let an unauthenticated attacker execute arbitrary code or create and alter instance data outside expected authorization limits; CVE-2026-74820 permits arbitrary SQL statements against the database. Open source The fourth flaw, CVE-2026-6876, is a sandbox escape in the Now Platform rated 8.7, and a sandbox escape rated lower than the others is a reminder of how the scoring works: severity tracks reachability, not conceptual seriousness.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source 2 Techzine 2026-08-28 Three of the four CVEs affect the AI Platform, the foundation layer supporting ServiceNow agent based AI functionality; CVE-2026-6876 is a Now Platform sandbox escape; patching program customers were updated automatically while self hosted customers must apply updates themselves. Open source
Fixes shipped across every supported release train rather than as a single patch. Affected builds include Xanadu before Patch 11 Hot Fix 7a, Yokohama before Patch 12 Hot Fix 3b and Patch 13 Hot Fix 4, and versions on the Zurich and Australia tracks.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source 3 Security Online 2026-08-27 Unauthenticated remote code execution in the GraphQL Composite Data API, privilege escalation via the image upload processor, unauthenticated SQL injection via a dynamic schema ORDER BY clause, and a sandbox escape; none recorded as exploited; fixes shipped as Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b and later builds. Open source Customers enrolled in the ServiceNow patching program received the updates automatically; self hosted and partner managed customers have to apply them by hand.2 Techzine 2026-08-28 Three of the four CVEs affect the AI Platform, the foundation layer supporting ServiceNow agent based AI functionality; CVE-2026-6876 is a Now Platform sandbox escape; patching program customers were updated automatically while self hosted customers must apply updates themselves. Open source That split is the operationally important sentence in the entire advisory, and it is the sentence least likely to be read.
ServiceNow stated it had not observed evidence of exploitation of the three critical issues, and no public exploit existed at the time of the reporting.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source 3 Security Online 2026-08-27 Unauthenticated remote code execution in the GraphQL Composite Data API, privilege escalation via the image upload processor, unauthenticated SQL injection via a dynamic schema ORDER BY clause, and a sandbox escape; none recorded as exploited; fixes shipped as Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b and later builds. Open source That is a vendor statement about vendor visibility, not an independent finding, and it says nothing about self hosted estates the vendor does not monitor. Read it as an absence of evidence rather than evidence of absence.
The pattern this fits into
This is not the first maximum tier finding against the layer ServiceNow's agents run on. On 30 October 2025 the company patched CVE-2025-12420, rated CVSS 9.3 and named BodySnatcher by its finder, Aaron Costello of AppOmni, which let an unauthenticated attacker impersonate any user from an email address alone by combining a hardcoded platform wide secret with account linking logic that trusted the address.5 The Hacker News 2026-01-15 CVE-2025-12420, named BodySnatcher and rated CVSS 9.3, allowed unauthenticated impersonation of any user from an email address by combining a hardcoded platform wide secret with account linking logic, bypassing MFA and SSO; affected Now Assist AI Agents (sn_aia) before 5.1.18 or 5.2.19 and the Virtual Agent API; patched 30 October 2025; found by Aaron Costello of AppOmni. Open source It bypassed both multi factor authentication and single sign on, and the affected components were named in the advisory as Now Assist AI Agents (sn_aia) before 5.1.18 or 5.2.19 and the Virtual Agent API.5 The Hacker News 2026-01-15 CVE-2025-12420, named BodySnatcher and rated CVSS 9.3, allowed unauthenticated impersonation of any user from an email address by combining a hardcoded platform wide secret with account linking logic, bypassing MFA and SSO; affected Now Assist AI Agents (sn_aia) before 5.1.18 or 5.2.19 and the Virtual Agent API; patched 30 October 2025; found by Aaron Costello of AppOmni. Open source The agent product was the attack surface, not an incidental bystander.
Three weeks after that patch, Costello published a second result of a different kind. A low privileged user can plant instructions inside a record so that a benign Now Assist agent, once triggered by a legitimate user, recruits other agents on its team to copy data, alter records and send email externally, all under the permissions of the person who started the interaction rather than the person who wrote the text.6 AppOmni Labs 2025-11-19 Second order prompt injection lets a low privileged user cause a benign Now Assist agent to recruit more capable agents to copy data, alter records and send external email under the triggering user's permissions; three defaults enable it (discovery out of the box, same channel agents grouped into a team, published agents discoverable); ServiceNow confirmed the behaviors were intended and updated documentation. Open source Three default settings make the chain work: agent discovery is supported out of the box, agents published to the same channel are grouped into one team, and published agents are marked discoverable.6 AppOmni Labs 2025-11-19 Second order prompt injection lets a low privileged user cause a benign Now Assist agent to recruit more capable agents to copy data, alter records and send external email under the triggering user's permissions; three defaults enable it (discovery out of the box, same channel agents grouped into a team, published agents discoverable); ServiceNow confirmed the behaviors were intended and updated documentation. Open source ServiceNow's security team confirmed the behaviors were intended and updated documentation instead of shipping a patch.6 AppOmni Labs 2025-11-19 Second order prompt injection lets a low privileged user cause a benign Now Assist agent to recruit more capable agents to copy data, alter records and send external email under the triggering user's permissions; three defaults enable it (discovery out of the box, same channel agents grouped into a team, published agents discoverable); ServiceNow confirmed the behaviors were intended and updated documentation. Open source
Put the three together and a structure appears. One class of problem gets a CVE and a hotfix within a release train. Another class, functionally identical from a victim's point of view, gets a documentation change because the platform is doing what it was configured to do. The weight of evidence suggests that agentic enterprise software has produced a category of exposure that the CVE process does not describe, and that defenders reading only the advisory feed will systematically undercount their risk. We hold that judgment at moderate confidence: it rests on one vendor, one researcher and a ten month window.
Who gains and who loses
The clear losers are self hosted and partner managed ServiceNow customers, named explicitly in the advisory coverage as the population that must patch manually.2 Techzine 2026-08-28 Three of the four CVEs affect the AI Platform, the foundation layer supporting ServiceNow agent based AI functionality; CVE-2026-6876 is a Now Platform sandbox escape; patching program customers were updated automatically while self hosted customers must apply updates themselves. Open source They now hold three unauthenticated, no interaction paths to code execution and database access in a system that typically stores the incident history, asset inventory and approval chains of the whole organization. A ServiceNow instance is an unusually good target precisely because it is the map of everything else.
The second order loser is the enterprise AI agent business case. Every agent deployment inherits the security posture of the platform hosting it, and the past ten months have handed procurement teams three concrete artifacts to point at: an authentication bypass in the agent components5 The Hacker News 2026-01-15 CVE-2025-12420, named BodySnatcher and rated CVSS 9.3, allowed unauthenticated impersonation of any user from an email address by combining a hardcoded platform wide secret with account linking logic, bypassing MFA and SSO; affected Now Assist AI Agents (sn_aia) before 5.1.18 or 5.2.19 and the Virtual Agent API; patched 30 October 2025; found by Aaron Costello of AppOmni. Open source , a privilege inheritance behavior the vendor declined to treat as a bug6 AppOmni Labs 2025-11-19 Second order prompt injection lets a low privileged user cause a benign Now Assist agent to recruit more capable agents to copy data, alter records and send external email under the triggering user's permissions; three defaults enable it (discovery out of the box, same channel agents grouped into a team, published agents discoverable); ServiceNow confirmed the behaviors were intended and updated documentation. Open source , and three unauthenticated CVSS 10.0 issues in the platform layer.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source None of that argues against agents. All of it lengthens security review.
The gainers are specific. SaaS security posture management vendors gain, and AppOmni most directly, since its researcher is named on both the impersonation flaw and the agent chaining research and its product category exists to catch exactly the configuration drift the second result describes.5 The Hacker News 2026-01-15 CVE-2025-12420, named BodySnatcher and rated CVSS 9.3, allowed unauthenticated impersonation of any user from an email address by combining a hardcoded platform wide secret with account linking logic, bypassing MFA and SSO; affected Now Assist AI Agents (sn_aia) before 5.1.18 or 5.2.19 and the Virtual Agent API; patched 30 October 2025; found by Aaron Costello of AppOmni. Open source 6 AppOmni Labs 2025-11-19 Second order prompt injection lets a low privileged user cause a benign Now Assist agent to recruit more capable agents to copy data, alter records and send external email under the triggering user's permissions; three defaults enable it (discovery out of the box, same channel agents grouped into a team, published agents discoverable); ServiceNow confirmed the behaviors were intended and updated documentation. Open source ServiceNow's own patching program gains, because the advisory's cleanest recommendation is effectively to be enrolled in it.2 Techzine 2026-08-28 Three of the four CVEs affect the AI Platform, the foundation layer supporting ServiceNow agent based AI functionality; CVE-2026-6876 is a Now Platform sandbox escape; patching program customers were updated automatically while self hosted customers must apply updates themselves. Open source Attackers with existing network reach to internal instances gain the most, and gain it for as long as the manual patch tail runs.
The counter case
The strongest argument against reading this as a systemic signal is that it is ordinary vulnerability management working. Four flaws were found, scored, patched across every supported release train, and disclosed with affected version detail, with no evidence of exploitation reported.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source 3 Security Online 2026-08-27 Unauthenticated remote code execution in the GraphQL Composite Data API, privilege escalation via the image upload processor, unauthenticated SQL injection via a dynamic schema ORDER BY clause, and a sandbox escape; none recorded as exploited; fixes shipped as Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b and later builds. Open source A vendor that publishes three perfect scores against itself is a vendor whose internal review is finding things. CVSS 10.0 also flatters severity: the score rewards reachability, and vendor assigned scores under CVSS v4.0 are not adjudicated by anyone else.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source For the thesis here to fail, two things would have to be true. First, the AI Platform concentration would have to be coincidence rather than exposure, which is plausible given that it is also the newest and most actively developed code. Second, the November configuration result would have to stay theoretical rather than appearing in a real incident. Neither has been ruled out.
What to watch
- Exploitation status changes within 90 days. If any of CVE-2026-18885, CVE-2026-18886 or CVE-2026-74820 moves from the vendor's no evidence position to confirmed in the wild activity before the end of November 2026, the manual patch tail is the story and self hosted estates are the casualty list.1 The Hacker News 2026-08-27 ServiceNow disclosed four vulnerabilities on 27 August 2026; CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 rated CVSS 10.0 and CVE-2026-6876 rated 8.7; all three criticals need no authentication, no privileges and no user interaction, with high confidentiality, integrity and availability impact; affected releases across Xanadu, Yokohama, Zurich and Australia; no observed evidence of exploitation as of 28 August 2026. Open source
- Whether the AI Platform keeps producing criticals. Three of four in August followed a 9.3 in the agent components in October 2025.2 Techzine 2026-08-28 Three of the four CVEs affect the AI Platform, the foundation layer supporting ServiceNow agent based AI functionality; CVE-2026-6876 is a Now Platform sandbox escape; patching program customers were updated automatically while self hosted customers must apply updates themselves. Open source 5 The Hacker News 2026-01-15 CVE-2025-12420, named BodySnatcher and rated CVSS 9.3, allowed unauthenticated impersonation of any user from an email address by combining a hardcoded platform wide secret with account linking logic, bypassing MFA and SSO; affected Now Assist AI Agents (sn_aia) before 5.1.18 or 5.2.19 and the Virtual Agent API; patched 30 October 2025; found by Aaron Costello of AppOmni. Open source Another critical in that same layer before the end of Q1 2027 would move the concentration read from moderate to high confidence.
- Whether ServiceNow changes the discoverability defaults. The November research turned on agents being grouped and discoverable by default.6 AppOmni Labs 2025-11-19 Second order prompt injection lets a low privileged user cause a benign Now Assist agent to recruit more capable agents to copy data, alter records and send external email under the triggering user's permissions; three defaults enable it (discovery out of the box, same channel agents grouped into a team, published agents discoverable); ServiceNow confirmed the behaviors were intended and updated documentation. Open source A release that flips those to off, rather than another documentation revision, is the signal that the vendor has reclassified configuration risk as product risk.
- Whether a second SaaS platform reproduces the pattern. Watch for an agent to agent privilege inheritance finding against another large workflow vendor within twelve months. One vendor is a vendor problem; two is a design pattern problem.
Model evaluation has absorbed most of the industry's safety attention this year. The exposure that actually reached production systems this month arrived through a GraphQL endpoint and an ORDER BY clause, underneath the model, in code no evaluation harness was ever pointed at.