Three CVSS 10.0 Service Now Flaws Could Let Unauthenticated Attackers Execute Code and SQL
Summary: ServiceNow released patches for four flaws in its AI Platform, three of them rated 10.0 on CVSS and described as exploitable in certain circumstances by an unauthenticated attacker with no privileges and no user interaction required. ServiceNow deployed the update to hosted instances and gave it to partners and self-hosted customers, who must apply the fixes themselves, and said in each of the four records that it is not currently aware of exploitation.
Bottom line: Self-hosted customers carry the patching burden for three maximum-severity, network-reachable flaws, and because none of the four appeared in CISA's Known Exploited Vulnerabilities catalog as of August 28, 2026, ServiceNow's own 10.0 ratings are the only severity assessment on record.