ServiceNow AI Platform Critical Unauthenticated RCE, Privilege Escalation, and SQL Injection Threat Hunt

Threat Overview

ServiceNow disclosed three maximum-severity vulnerabilities in the ServiceNow AI Platform on August 27, 2026. CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820 are each rated CVSS 10.0 and can, in certain circumstances, be exploited remotely by unauthenticated attackers with low complexity and no user interaction.

CVE-2026-18885 is a code-injection issue in the GraphQL Composite Data API that can allow arbitrary code execution and unauthorized instance-data access or modification. CVE-2026-18886 is an improper-access-control flaw in the system configuration image upload processor that can enable unauthenticated privilege escalation and data modification. CVE-2026-74820 is an SQL-injection vulnerability that can allow unauthorized access to or modification of instance data.

ServiceNow stated that hosted instances received the security update and that it was not aware of malicious exploitation of these three vulnerabilities at the time of disclosure. Self-hosted and partner-managed customers must ensure they are running a fixed patch or hot-fix level.

References

Impacted Systems

Vendor / Product	ServiceNow AI Platform
CVE-2026-18885	CVSS 10.0 code injection in GraphQL Composite Data API; unauthenticated RCE/data access possible in certain circumstances
CVE-2026-18886	CVSS 10.0 improper access control in system configuration image upload processor; unauthenticated privilege escalation/data modification possible
CVE-2026-74820	CVSS 10.0 SQL injection; unauthorized data access/modification possible
Hosted ServiceNow	ServiceNow states hosted instances received the security update
Self-hosted / partner-managed	Customer or partner action required to apply fixed releases
Fixed Xanadu	Patch 11 Hot Fix 7a
Fixed Yokohama	Patch 12 Hot Fix 3b or Patch 13 Hot Fix 4
Fixed Zurich	Patch 7b Hot Fix 3; Patch 8 Hot Fix 5; Patch 9 Hot Fix 6; Patch 10 Hot Fix 2m (m-branch); Patch 10 Hot Fix 3 (standard); Patch 11; Patch 12
Fixed Australia	Patch 2 Hot Fix 3; Patch 3 Hot Fix 2; Patch 3m; Patch 4; Patch 5
Known exploitation	ServiceNow stated it was not aware of malicious exploitation of these three flaws as of August 28

Why this matters

ServiceNow instances can contain CMDB data, privileged workflow records, credentials, ticket data, integration tokens, and business-critical automations. Pre-authentication server-side code execution or privilege escalation against a self-hosted instance could provide a high-impact initial-access path even without confirmed exploitation.

Exploitation Status

No confirmed malicious exploitation of these three vulnerabilities was reported by ServiceNow as of August 28, 2026. Hosted ServiceNow instances were provider-updated; self-hosted and partner-managed instances require customer/partner patch validation.

What this hunt looks for

GraphQL-focused traffic, first-seen GraphQL clients, image-upload requests, SQL-injection-like request patterns, high-volume POST activity, suspicious WAF actions, and self-hosted application-process behavior where endpoint telemetry is available.

Required logs

CommonSecurityLog or equivalent WAF/reverse-proxy/web access telemetry
Native ServiceNow access/audit logs when ingested into Sentinel
DeviceProcessEvents for self-hosted ServiceNow systems
Syslog as a web/proxy fallback

Hunt 1 — First-Pass: GraphQL POST Requests to ServiceNow

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationHostName has_any ("service-now.com","servicenow") or RequestURL has "servicenow"
| where RequestURL has "graphql"
| where RequestMethod =~ "POST"
| project TimeGenerated, SourceIP, DestinationHostName, RequestMethod, RequestURL, RequestClientApplication, DeviceAction, Message
| sort by TimeGenerated asc

Hunt 2 — First-Seen GraphQL Sources Compared With Baseline

let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| where DestinationHostName has_any ("service-now.com","servicenow") or RequestURL has "servicenow"
| where RequestURL has "graphql"
| summarize by SourceIP, DestinationHostName;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationHostName has_any ("service-now.com","servicenow") or RequestURL has "servicenow"
| where RequestURL has "graphql"
| join kind=leftanti Baseline on SourceIP, DestinationHostName
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URLs=make_set(RequestURL,50), UserAgents=make_set(RequestClientApplication,20) by SourceIP, DestinationHostName
| sort by FirstSeen desc

Hunt 3 — Image Upload or Configuration-Oriented Requests

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationHostName has_any ("service-now.com","servicenow") or RequestURL has "servicenow"
| where RequestMethod in~ ("POST","PUT","PATCH")
| where RequestURL has_any ("image","upload","sys_properties","configuration")
| project TimeGenerated, SourceIP, DestinationHostName, RequestMethod, RequestURL, RequestClientApplication, DeviceAction, Message
| sort by TimeGenerated asc

Hunt 4 — SQL-Injection-Like Patterns in ServiceNow Requests

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationHostName has_any ("service-now.com","servicenow") or RequestURL has "servicenow"
| where RequestURL has_any ("union%20select","union+select","%27%20or%20","' or ","sleep(","benchmark(","information_schema","%3bselect","%27--") or Message has_any ("union select","information_schema","sleep(","benchmark(","' or ")
| project TimeGenerated, SourceIP, DestinationHostName, RequestMethod, RequestURL, RequestClientApplication, DeviceAction, Message
| sort by TimeGenerated asc

Hunt 5 — High-Volume POST Activity to ServiceNow

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationHostName has_any ("service-now.com","servicenow") or RequestURL has "servicenow"
| where RequestMethod =~ "POST"
| summarize Requests=count(), UniqueURLs=dcount(RequestURL), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), UserAgents=make_set(RequestClientApplication,20), Actions=make_set(DeviceAction,20) by SourceIP, DestinationHostName, bin(TimeGenerated,15m)
| where Requests >= 50 or UniqueURLs >= 20
| sort by Requests desc

Hunt 6 — WAF or Security Device Actions on Suspicious ServiceNow Requests

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationHostName has_any ("service-now.com","servicenow") or RequestURL has "servicenow"
| where RequestURL has_any ("graphql","image","upload") or Message has_any ("SQL","injection","code injection","command")
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Actions=make_set(DeviceAction,20), URLs=make_set(RequestURL,50) by SourceIP, DestinationHostName, DeviceVendor, DeviceProduct
| sort by Events desc

Hunt 7 — Self-Hosted ServiceNow Java Process Spawning Shells

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("java.exe","java")
| where InitiatingProcessCommandLine has_any ("servicenow","service-now","glide")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","bash","sh","curl.exe","curl","wget.exe","wget","python.exe","python")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 8 — ServiceNow-Oriented Web/Proxy Syslog Fallback

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("servicenow","service-now","graphql")
| where SyslogMessage has_any ("POST ","PUT ","PATCH ","upload","union select","information_schema","sleep(","benchmark(")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Detection Notes

ServiceNow did not report active exploitation of these three vulnerabilities as of August 28. Treat suspicious results as investigation leads, not proof of exploitation.
GraphQL and image-upload queries are strongest when the customer has self-hosted ServiceNow behind a WAF/reverse proxy that logs request paths and methods.
SQL-injection pattern matching is heuristic and can generate false positives from encoded business data or security testing.
Endpoint process hunts apply only to self-hosted ServiceNow systems where the application runtime is covered by endpoint telemetry.
Hosted ServiceNow customers may have limited infrastructure-level visibility because ServiceNow manages the platform layer.