Three Critical ServiceNow Platform Vulnerabilities Could Allow Arbitrary Execution, Privilege Escalation

ServiceNow published a security advisory on 2026-08-27 disclosing four vulnerabilities across its AI and Now Platforms — three rated CVSS 10.0 (unauthenticated code injection, improper access control allowing privilege escalation, and SQL injection via ORDER BY) and one CVSS 8.7 sandbox escape — affecting multiple releases; SaaS instances enrolled in patching have been updated automatically while self-hosted customers must apply patches immediately, and recommended mitigations include disabling unauthenticated upload paths, monitoring logs, applying patches, and using WAFs.