ServiceNow AI Platform vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

SA

Product

ServiceNow AI Platform

by ServiceNow · last CVE Sep 24, 2026

14

CVEs

0

On KEV

10.0

Max CVSS

0

New 30D

Vulnerabilities14 In the news3 Timeline

Severity mix

Critical 8High 3Medium 3Low 0

Severity

All severities14 Critical8 High3 Medium3 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add ServiceNow AI Platform to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-74820	10.0	5%	Aug 27	Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause Affected: before Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 12 Hot Fix 3b; before Yokohama Patch 13 Hot Fix 4; before Zurich Patch 7b Hot Fix 3; before Zurich Patch 8 Hot Fix 5; before Zurich Patch 9 Hot Fix 6; +9 more
CVE-2026-18886	10.0	5%	Aug 27	Unauthenticated Privilege Escalation via System Configuration Image Upload Processor Affected: before Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 12 Hot Fix 3b; before Yokohama Patch 13 Hot Fix 4; before Zurich Patch 7b Hot Fix 3; before Zurich Patch 8 Hot Fix 5; before Zurich Patch 9 Hot Fix 6; +9 more
CVE-2026-18885	10.0	7%	Aug 27	Unauthenticated Remote Code Execution in GraphQL Composite Data API Affected: before Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 12 Hot Fix 3b; before Yokohama Patch 13 Hot Fix 4; before Zurich Patch 7b Hot Fix 3; before Zurich Patch 8 Hot Fix 5; before Zurich Patch 9 Hot Fix 6; +9 more
CVE-2026-6876	10.0	1%	Aug 27	Sandbox Escape in ServiceNow AI Platform Affected: before Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 12 Hot Fix 3b; before Yokohama Patch 13 Hot Fix 4; before Zurich Patch 7b Hot Fix 3; before Zurich Patch 8 Hot Fix 5; before Zurich Patch 9 Hot Fix 6; +9 more
CVE-2026-6875	9.5	1%	Jul 13	Sandbox Escape in ServiceNow AI Platform Affected: before Australia Patch 2; before Yokohama Patch 12 Hot Fix 1b; before Yokohama Patch 13; before Zurich Patch 7b; before Zurich Patch 9; before Brazil EA; +1 more
CVE-2026-86860	9.3	0%	Sep 24	Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform Affected: before Yokohama Patch 13 Hot Fix 5a; before Zurich Patch 10 Hot Fix 3b; before Zurich Patch 10 Hot Fix 4a W32; before Zurich Patch 11 Hot Fix 3; before Australia Patch 2 Hot Fix 4b W32; before Australia Patch 4 Hot Fix 3; +1 more
CVE-2026-13016	9.3	0%	Sep 24	Unauthenticated SQL Injection in ServiceNow AI Platform Affected: before Yokohama Patch 13 Hot Fix 5a; before Zurich Patch 10 Hot Fix 3b; before Zurich Patch 10 Hot Fix 4a W32; before Zurich Patch 11 Hot Fix 3; before Australia Patch 2 Hot Fix 4b W32; before Australia Patch 4 Hot Fix 3; +1 more
CVE-2026-0542	9.2	1%	Feb 25	Remote Code Execution in ServiceNow AI Platform Affected: before Australia; before Zurich Patch 5; before Zurich Patch 4 Hot Fix 3b; before Yokohama Patch 12; before Yokohama Patch 10 Hot Fix 1b; before Xanadu Patch 11 Hot Fix 1a
CVE-2026-86859	8.7	0%	Sep 24	Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform Affected: before Yokohama Patch 13 Hot Fix 5a; before Zurich Patch 10 Hot Fix 3b; before Zurich Patch 10 Hot Fix 4a W32; before Zurich Patch 11 Hot Fix 3; before Australia Patch 2 Hot Fix 4b W32; before Australia Patch 4 Hot Fix 3; +1 more
CVE-2026-86858	8.7	0%	Sep 24	Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform Affected: before Yokohama Patch 13 Hot Fix 5a; before Zurich Patch 10 Hot Fix 3b; before Zurich Patch 10 Hot Fix 4a W32; before Zurich Patch 11 Hot Fix 3; before Australia Patch 2 Hot Fix 4b W32; before Australia Patch 4 Hot Fix 3; +1 more
CVE-2026-86857	8.4	0%	Sep 24	Authorization Bypass in ServiceNow AI Platform Affected: before Yokohama Patch 13 Hot Fix 5a; before Zurich Patch 10 Hot Fix 3b; before Zurich Patch 10 Hot Fix 4a W32; before Zurich Patch 11 Hot Fix 3; before Australia Patch 2 Hot Fix 4b W32; before Australia Patch 4 Hot Fix 3; +1 more
CVE-2025-11449	5.3	0%	Oct 10	Reflected Cross Site Scripting in ServiceNow AI Platform Affected: before Washington DC Patch 10 Hot Fix 7b; before Xanadu Patch 10 Hot Fix 1a; before Xanadu Patch 11; before Yokohama Patch 7 Hot Fix 2a; before Yokohama Patch 8; before Yokohama Patch 9; +4 more
CVE-2025-11450	5.3	0%	Oct 10	Reflected Cross Site Scripting in ServiceNow AI Platform Affected: before Washington DC Patch 10 Hot Fix 7b; before Xanadu Patch 10 Hot Fix 1a; before Xanadu Patch 11; before Yokohama Patch 7 Hot Fix 2a; before Yokohama Patch 8; before Yokohama Patch 9; +4 more
CVE-2025-3089	5.3	0%	Aug 12	Broken Access Control in ServiceNow AI Platform Affected: Aspen before Washington DC Patch 10 Hot Fix 2a; Aspen before Xanadu Patch 7a; Aspen before Xanadu Patch 8; Aspen before Yokohama Patch 1a; Aspen before Yokohama Patch 2; Aspen before Zurich (EA)