CVE-2026-18886

Published Aug 27, 2026

Last updated 2 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-18886 is an improper access control vulnerability found within the ServiceNow AI Platform. This flaw allows an unauthenticated attacker to create or modify instance data beyond its intended scope. Successful exploitation of this vulnerability can lead to privilege escalation, enabling malicious actors to gain elevated access and control over the affected ServiceNow instance. The vulnerability is reachable over the network against internet-exposed ServiceNow instances without requiring credentials.

Description: ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Source: psirt@servicenow.com
NVD status: Received

Risk scores

CVSS 4.0

Type: Secondary
Base score: 10
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-284

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 2

References