What Happened
On August 27, 2026, ServiceNow disclosed four vulnerabilities in its AI Platform, with three rated at the highest severity level, CVSS 10.0. These flaws allow attackers to execute arbitrary code or SQL commands without authentication. ServiceNow released patches for these vulnerabilities alongside the advisory. If your organization runs self-hosted ServiceNow instances, you'll need to apply these patches manually. ServiceNow, as the CVE Numbering Authority for its products, assigned CVE identifiers to each vulnerability.
Timeline
August 27, 2026: ServiceNow publishes a security advisory and releases patches for four vulnerabilities in the AI Platform.
Same day: Three vulnerabilities, including CVE-2026-18885, are confirmed at CVSS 10.0, indicating critical severity.
Current status: Patches are available. Self-hosted customers are responsible for deployment. No confirmed exploitation in the wild has been reported.
Which Controls Failed or Were Missing
This incident highlights gaps in three control areas:
Vulnerability identification and assessment: The vulnerabilities reached production code. While ServiceNow identified and patched them, self-hosted users had no advance warning. If you're running a self-hosted instance, you learned about these flaws at the same time as potential attackers.
Patch deployment process: Self-hosted environments place the patching responsibility on you. Without a documented process for emergency patches, including after-hours procedures and rollback plans, you're patching under pressure without a clear plan.
Authentication boundaries: The vulnerabilities allow unauthenticated access, making your perimeter controls, like network segmentation and VPN requirements, your only defense until you patch. If an attacker can reach your ServiceNow instance over the network, they can exploit these flaws.
What the Standards Require
PCI DSS v4.0.1 Requirement 6.3.1 states: "Security vulnerabilities are identified and addressed using industry-recognized sources." For self-hosted ServiceNow instances processing payment data, you must monitor ServiceNow's security advisories and respond based on risk.
Requirement 6.3.2 mandates maintaining an inventory of software components to facilitate vulnerability and patch management. If ServiceNow isn't in your inventory with version tracking, you violated this requirement before the advisory.
Requirement 6.3.3 specifies timing: "All system components are protected from known vulnerabilities by installing applicable security patches/updates... Critical patches are installed within one month of release." For CVSS 10.0 vulnerabilities, 30 days is the maximum, but your risk assessment should prompt a faster response.
ISO/IEC 27001:2022 Control 8.8 requires: "Information about technical vulnerabilities of information systems in use shall be obtained, and appropriate measures shall be taken." For self-hosted instances, this means patching or implementing compensating controls immediately.
NIST 800-53 Rev 5 SI-2 specifies: "Install security-relevant software and firmware updates within the time period directed by the organization after the release of the updates." The control enhancement SI-2(2) adds: "Install security-relevant software and firmware updates automatically." Self-hosted environments typically can't auto-update, so you need a defined manual process.
Lessons and Action Items for Your Team
Build a vendor advisory monitoring process. Assign someone to monitor ServiceNow's security advisories and those of every other enterprise platform you use. Set up RSS feeds, email alerts, or use a vulnerability intelligence service. Check daily.
Document your self-hosted patch workflow now. Define who approves emergency patches, who tests them, who deploys them, and your rollback procedure. Include after-hours contact information. When the next CVSS 10.0 advisory drops, you won't have time to figure this out.
Test your patch process with a non-critical update. Deploy a routine ServiceNow patch in your test environment this quarter. Time each step. Identify bottlenecks. Ensure your backup process works before you need it under pressure.
Review your network segmentation. These vulnerabilities don't require authentication. Limit network access to ServiceNow to specific IP ranges or VPN-only access. This reduces your attack surface while you patch.
Reassess your self-hosted vs. cloud decision. ServiceNow's cloud instances get patched automatically. If your team struggles to deploy patches within 30 days, you're carrying risk that a cloud deployment would eliminate. Calculate the cost of your patch management burden against cloud pricing.
Update your software inventory today. Add ServiceNow with its current version number, deployment model, and patch schedule. Include contact information for your ServiceNow account team. This inventory is required by PCI DSS v4.0.1 Requirement 6.3.2 and is essential for operational hygiene.
Define your critical patch timeline. "Within 30 days" is the PCI DSS maximum. For CVSS 10.0 vulnerabilities, 30 days is too slow. Document a timeline for critical vulnerabilities: 72 hours for assessment, seven days for deployment. Get executive sign-off now, before the next emergency.
The ServiceNow advisory underscores a hard truth about self-hosted enterprise software: you own the patch timeline, testing burden, and risk window. Three CVSS 10.0 vulnerabilities don't allow for a slow response.
