ServiceNow’s AI Platform is the cloud foundation beneath the company’s workflow products: IT service management, HR and employee services, security and risk work, customer operations, and application development all use its shared data and automation model. That makes CVE-2026-18885 consequential for the medium and large organisations that run those workflows, including banks, healthcare providers, manufacturers, retailers, telecoms, technology companies, nonprofits, and government bodies.
The issue sits in the platform’s GraphQL Composite Data API. GraphQL is an API query language: a client asks for particular fields and related records rather than calling a separate endpoint for every data shape. ServiceNow classifies this flaw as code injection, meaning input reaching that API can, under conditions the advisory does not spell out, be interpreted as code rather than handled only as data. The public material does not identify the vulnerable field, execution path, missing validation, or the patch’s exact logic.
No account is required for the described outcome
ServiceNow says an unauthenticated user could execute arbitrary code in the platform and access or modify instance data beyond intended limits. In practical terms, the stated precondition is network reachability to the affected service, not a ServiceNow login, a privileged role, or user interaction. The vendor’s record assigns the issue CVSS v4.0 10.0 and credits Adam Kues of Assetnote with reporting it; the affected branches and fixed builds are enumerated in that record.
“Under certain circumstances” is an important limitation, not filler: ServiceNow has not publicly described what those circumstances are. Teams should therefore avoid assuming that a particular configuration, instance use case, or API exposure pattern makes them safe.
As of September 1, there was no confirmed malicious exploitation, no incident or campaign tied directly to CVE-2026-18885, and no public proof of concept or exploit code. It was also not listed in CISA’s Known Exploited Vulnerabilities catalogue. Reports of exploitation of CVE-2026-6875 concern a different ServiceNow issue and should not be carried over to this one. CVE-2026-18885 was disclosed alongside other high-severity ServiceNow AI Platform issues, including CVE-2026-18886 and CVE-2026-6876, but that context is not evidence of exploitation here.
Hosted instances were updated; other operators must act
A patch exists. ServiceNow says it deployed the security update to hosted instances and made it available to partners and self-hosted customers. Its August advisory recommends applying the appropriate update or upgrading to a patched release promptly.
There is no single fixed version: the published affected ranges span Xanadu, Yokohama, Zurich, and Australia patch branches, each with its own first fixed hotfix or patch level. Inventory the instance’s precise release branch and patch level, then compare it with the vendor’s fixed-build list before scheduling work. The available material could not confirm a workaround independent of updating or upgrading, so compensating controls should not replace the vendor fix.
For IT owners, verify whether the instance is ServiceNow-hosted or operated by a partner or your own team, obtain confirmation of the installed remediation, and record it. Given the unauthenticated path described here, treat this as an urgent exposure check rather than a routine maintenance item. SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs, which can help keep that verification from becoming a one-off exercise.
