Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

ServiceNow has released security patches for four critical vulnerabilities in its AI Platform, including three rated at 10.0 CVSS, that could allow unauthenticated attackers to execute code, create or modify instance data, and potentially gain access to underlying databases. While ServiceNow states it’s not currently aware of exploitation, a security firm, Searchlight Cyber, had published a proof-of-concept exploit for one of the vulnerabilities (CVE-2026-6875) in July. The company urges self-hosted and ServiceNow-hosted customers to apply the relevant patches immediately.