ServiceNow's 27 August 2026 CVE record (CNA title: Sandbox Escape in ServiceNow AI Platform) says it remediated a sandbox-escape issue that could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform and gain more access than intended. ServiceNow scores it 10.0 (CVSS 4.0, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).

Hosted instances received a vendor-deployed security update; partners and self-hosted customers were given the update. ServiceNow says it is not currently aware of malicious exploitation against ServiceNow instances.

Self-hosted operators should apply the August 2026 CVE advisory updates (KB3152242). CNA-listed affected rows span Xanadu, Yokohama, Zurich and Australia patch families (including builds before Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b / Patch 13 Hot Fix 4, Zurich Patch 7b–12 hotfixes as listed, and Australia Patch 2–5 hotfixes as listed). Same-day desk cards cover the three CVSS 4.0 10.0 AI Platform issues (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820).

Correction (23 Oct 2026): this card said ServiceNow scored CVE-2026-6876 at 8.7 (CVSS 4.0) with a vector requiring low privileges and named the product Now Platform. ServiceNow's CVE record (last updated 1 September 2026) scores it 10.0 (CVSS 4.0) with no privileges required (PR:N) and names the product ServiceNow AI Platform. Updated 24 Oct 2026: the facts box now also shows the CVE record's product name and CVSS 4.0 vector. (source: CVE-2026-6876 record (cve.org))