No Login Required: Three Perfect-10 Flaws Hit the Platform That Runs Your Enterprise
ServiceNow’s triple CVSS 10.0 advisory shows what happens when your system of record becomes an AI platform — and why the patch window keeps shrinking
September 11, 2026 | By The CyberSurv Team | CyberSurv
Three vulnerabilities. Three perfect 10.0 severity scores. Zero authentication required. On August 27, ServiceNow published an advisory that should stop every technology leader mid-scroll. The flaws sit in what the company now calls the ServiceNow AI Platform — the rebranded Now Platform that runs IT service management, security operations and asset workflows for thousands of enterprises, including port operators, terminal companies and shipping lines.
A single CVSS 10.0 is rare. Three at once, in the same platform, all exploitable by an attacker with no credentials and no user interaction? That’s a signal worth reading closely. We think it says as much about where enterprise AI is headed as it does about ServiceNow.
Three Maximum-Severity Flaws, Zero Authentication
Here’s what the advisory covers. CVE-2026-18885 is a code injection flaw in the platform’s GraphQL Composite Data API that lets an unauthenticated attacker execute arbitrary code on the instance. CVE-2026-18886 is an access control failure in system configuration image upload that allows data modification and privilege escalation. CVE-2026-74820 is a SQL injection through a dynamic schema ORDER BY clause — arbitrary SQL, straight against the database. A fourth flaw, CVE-2026-6876, is a sandbox escape rated 8.7 that also permits unauthenticated code execution.
Affected release families span Xanadu, Yokohama, Zurich and Australia. ServiceNow has already patched its hosted instances and released hotfixes for self-hosted deployments. The company says it hasn’t observed exploitation and no public exploit code exists yet. That word — yet — is doing a lot of work.
The Fuse Is Shorter Than Your Change Window
Why the urgency if nobody’s exploiting these? Because we’ve already watched this movie. When ServiceNow patched a similar sandbox escape in July, attackers were scanning for the affected endpoint within hours of disclosure. Exploitation in the wild began within five days of the patch release. Five days. Many enterprises can’t get an emergency change approved that fast, let alone tested and deployed across regional instances.
The broader trend makes those five days look generous. We recently covered how researchers used an AI model to port a working exploit to a new device in under nine hours for about $500 in API costs. Meanwhile, defenders are drowning: Microsoft’s September Patch Tuesday shipped fixes for a record 973 vulnerabilities in a single release. Attackers need one working path. You need to close all of them, faster than ever, with the same staff you had last year.
The Platform That Knows Everything About You
Now consider what actually lives inside a ServiceNow instance. The CMDB holds your complete asset inventory — every server, switch, application and, increasingly, every OT and shipboard system your teams track. Ticket history documents years of incidents, misconfigurations and known weaknesses in plain language. Workflow automation holds credentials and integration tokens that reach into email, identity providers and cloud environments. For maritime operators using the platform to manage shore-side IT and vessel maintenance workflows, it’s effectively a map of the fleet.
That’s why unauthenticated access to this platform isn’t just a data breach risk. It’s design-basis intelligence for whoever gets in. An attacker who can query your CMDB doesn’t need to run noisy reconnaissance against your network; you’ve already done the documentation for them. And an attacker who can execute code inside your workflow engine can push changes outward through every integration you’ve built. The system of record becomes the system of compromise.
When “AI Platform” Stops Being a Buzzword
ServiceNow didn’t rename its flagship product by accident. Agentic AI now runs through its workflows — triaging tickets, executing playbooks, taking actions that used to require a human. The same shift is happening across the enterprise stack, and the security data is starting to catch up with it. HiddenLayer’s 2026 AI Threat Landscape Report found that one in eight reported AI breaches already involves agentic systems.
CISA and its international partners warned about exactly this in their agentic AI guidance: expanded attack surface, privilege creep, behavioral misalignment and event records too opaque to audit. We’ve written about what happens when AI agents slip their guardrails and about the flaws that turn enterprise AI assistants into privileged insiders. The ServiceNow advisory adds the missing piece: the platforms hosting those agents are themselves critically exposed. When the foundation cracks, everything built on it inherits the fault.
What We’d Do This Week
If your organization runs ServiceNow — or any AI-infused platform of record — here’s where we’d focus:
- Confirm the hotfix, don’t assume it. Hosted customers were patched by ServiceNow; self-hosted instances need the hotfix applied and verified per release family.
- Hunt backward. Review instance logs since late August for unusual GraphQL queries, unexpected image uploads and unrecognized accounts or scheduled jobs.
- Cut the exposure. Instance APIs reachable from the open internet deserve a hard second look. Restrict what you can behind VPN or IP allowlists.
- Move these platforms into Tier 0. Your CMDB and workflow engine deserve the same protection as your domain controllers, because they hold equivalent power.
- Test them like attackers will. Enterprise SaaS and AI platforms belong in your penetration testing scope, not outside it.
- Watch continuously. A five-day exploitation fuse demands monitoring that never clocks out. That’s the gap our RiskGuard 365℠ service was built to close — continuous visibility across IT and OT so a new advisory becomes a work order, not a scramble.
And if the governance question — who owns AI platform risk in your organization? — has no clear answer, our Security Leadership Program exists precisely to put a name next to it.
Final Thoughts
The ServiceNow advisory will fade from the headlines within a month. The pattern behind it won’t. Enterprises spent a decade consolidating their operations into a handful of powerful platforms, and those platforms are now racing to embed autonomous AI in every workflow. Each perfect-10 flaw in that foundation is a reminder that consolidation cuts both ways: the platform that makes your operation efficient makes your attacker efficient too.
Patch fast, verify faster and treat the systems that know everything about you as the crown jewels they’ve become. The next advisory is already in someone’s disclosure queue.
Let’s Explore What’s Possible
Whether you need continuous monitoring, a hard look at your platform exposure or a maritime cybersecurity assessment that covers shore and ship alike, our team is ready to help you get ahead of the next perfect 10.
