What Happened
ServiceNow patched three critical vulnerabilities in its AI Platform that allowed unauthenticated attackers to execute arbitrary code and SQL statements without user interaction. The vulnerabilities, CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, affected the platform's AI capabilities and could be exploited to manipulate enterprise data across ServiceNow instances.
All three flaws scored maximum severity ratings. The code injection vulnerability (CVE-2026-18885) allowed attackers to execute arbitrary code through the AI Platform. The SQL injection flaw (CVE-2026-18886) permitted direct database manipulation. The privilege escalation issue (CVE-2026-74820) let attackers elevate their access without authentication.
Timeline
Discovery to Patch: ServiceNow identified and patched all three vulnerabilities, releasing fixes for immediate application.
No Public Exploitation: There's no evidence of active exploitation before the patches were released.
Immediate Action Required: Organizations using affected ServiceNow AI Platform versions needed to apply patches immediately due to the unauthenticated nature of the exploits.
Which Controls Failed or Were Missing
Input Validation: The platform didn't properly sanitize user input before processing it through AI components, causing both the code injection and SQL injection vulnerabilities. Treat all input as hostile until proven otherwise.
Parameterized Queries: The SQL injection vulnerability shows the platform wasn't using parameterized queries or prepared statements consistently. Avoid direct string concatenation in SQL queries.
Authentication Checks: The privilege escalation flaw indicates missing or inadequate authentication verification before granting elevated access. Validate user identity before allowing sensitive operations.
Security Testing in Development: These vulnerabilities should have been caught during static analysis, dynamic testing, or code review. Their presence in production suggests gaps in the secure development lifecycle.
What the Standards Require
OWASP Top 10 2021 lists injection attacks as the third most critical web application security risk (A03:2021). It emphasizes defense through parameterized queries and input validation.
OWASP ASVS v4.0.3 provides specific requirements:
- Requirement 5.3.4: Use parameterized queries, ORMs, or entity frameworks to protect from database injection attacks.
- Requirement 5.3.8: Protect all SQL queries with prepared statements or parameterized queries to prevent SQL injection.
PCI DSS v4.0.1 Requirement 6.2.4 mandates secure development of bespoke and custom software, with attention to injection flaws. If your ServiceNow instance processes payment data, address these vulnerabilities immediately.
ISO/IEC 27001:2022 Control 8.25 requires a secure development lifecycle that includes security requirements for information systems. Injection vulnerabilities in production indicate this control wasn't effectively implemented.
SOC 2 Type II Common Criteria CC6.6 requires logical access controls that restrict access based on user roles. The privilege escalation vulnerability directly violates this criterion by allowing unauthorized access elevation.
Lessons and Action Items for Your Team
Patch Now, Not Later: If you're running ServiceNow AI Platform, apply these patches immediately. The unauthenticated nature of these exploits means attackers don't need credentials to start probing your instance.
Audit Your Own Input Validation: Use this incident as a trigger to review your own applications. Run static analysis tools specifically looking for:
- SQL queries built with string concatenation
- User input passed directly to eval() or exec() functions
- Dynamic code generation that includes user-supplied data
Implement Parameterized Queries Everywhere: Review every database interaction in your codebase. If you see string concatenation in SQL queries, rewrite them as parameterized queries. This isn't optional, it's the only reliable defense against SQL injection.
Add Authentication Checks to Privilege Changes: Every function that elevates privileges or grants access must verify the user's identity and authorization. Don't rely on client-side checks or assume the calling code has already authenticated the user.
Test for Injection Vulnerabilities in CI/CD: Add automated security testing to your pipeline:
- Static analysis tools (like Semgrep or SonarQube) to catch injection patterns
- Dynamic testing tools (like OWASP ZAP or Burp Suite) to probe for SQL and code injection
- Dependency scanning to catch vulnerable libraries before they reach production
Review AI/ML Component Security: If you're building AI features, pay special attention to how user input flows into model inference, data processing, or code generation. AI components often handle complex data transformations where injection vulnerabilities can hide.
Document Your Secure Coding Standards: Create specific guidelines for your team:
- Never concatenate user input into SQL queries
- Never pass user input to code execution functions
- Always validate and sanitize input at system boundaries
- Use allowlists for input validation, not blocklists
Run a Tabletop Exercise: Walk through how your team would respond if you discovered similar vulnerabilities in your own platform. Who gets notified? How quickly can you patch? Do you have a communication plan for customers?
These vulnerabilities aren't novel attack vectors. SQL injection has been on the OWASP Top 10 for over a decade. The fact that a major enterprise platform shipped with these flaws shows that knowing about injection attacks isn't enough, you need systematic controls to prevent them from reaching production.
