THIS article outlines critical vulnerabilities identified in ServiceNow, highlighting four significant flaws disclosed on August 27, 2026, with three of them rated at a maximum CVSS score of 10, indicating critical severity. The vulnerabilities include code injection and SQL injection issues that could allow unauthenticated users to execute arbitrary code and gain unauthorized access to instance data.
Notably, there is current no confirmed exploitation of these vulnerabilities; however, patches have been provided for affected versions. Organizations using the ServiceNow platform are urged to update to the latest patches to safeguard against potential attacks.