{"data":{"id":"702a8e0f-909e-4ead-946b-51931361033e","title":"ServiceNow patches three maximum severity flaws that could put enterprise data at risk","summary":"ServiceNow released patches for three maximum-severity vulnerabilities in its AI Platform that could allow attackers to execute arbitrary code, modify data, and escalate privileges without requiring user authentication or interaction. These flaws exploit code injection (inserting malicious code into input fields) and SQL injection (manipulating database queries), which remain effective attack methods decades after their discovery. Cloud-based instances have been automatically updated, but ServiceNow urges self-hosted customers to apply patches immediately.","solution":"ServiceNow has released patches for the three critical vulnerabilities (CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820) as well as the high-severity CVE-2026-6876. The company advises self-hosted customers to 'upgrade or patch immediately.' The patches are available for impacted Xanadu, Yokohama, and Zurich versions of the platform.","labels":["security"],"sourceUrl":"https://www.csoonline.com/article/4215430/servicenow-patches-three-maximum-severity-flaws-that-could-put-enterprise-data-at-risk.html","publishedAt":"2026-08-28T22:59:31.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":[],"affectedVendorsRaw":["ServiceNow","ServiceNow AI Platform"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-08-28T22:59:31.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}