CVE-2026-18886 is the one both write-ups treat as an afterthought. ServiceNow describes it as improper access control in the system configuration image upload processor, letting an unauthenticated user create or modify instance data and escalate privileges [4]. The three maximum-severity records share one vector string, and the tail of it matters more than the 10.0: SC:H/SI:H/SA:H, meaning high impact to the systems connected to the vulnerable component, not only the component [6]. That is scoring language for blast radius, and this platform integrates AI into core enterprise workflows and runs more than 100,000 enterprise AI apps at 85 percent of the Fortune 500 [20].
The scores are ServiceNow's own. It is the CVE Numbering Authority for its products [15], and since April 15, 2026 NIST has enriched only vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, those affecting federal government software, or those designated critical under Executive Order 14028 [16]. None of the four was in the catalog as of August 28, so the vendor's rating is the only assessment on record [17]. Read it against July: ServiceNow scored CVE-2026-6875 at 9.5 with every metric identical to the new three except attack complexity, which it set to high [13]. The half point is attack complexity and nothing else [14]. AC:L on the new three is the vendor saying no special conditions are required.
July is why that metric carries weight. Searchlight Cyber reported CVE-2026-6875 on April 1, 2026, and ServiceNow published on July 13, 103 days later [10][23]. Days after that advisory, Defused said it was observing in-the-wild exploitation, then corrected itself: the captured payload matched Searchlight's published proof of concept [11]. ServiceNow said it had seen no evidence the activity involved instances it hosts [12]. What is public, then, is a payload derived from a public PoC landing on reachable instances. Malicious operator activity stays unconfirmed.
Forty-five days separate the two advisories [24]. The pattern around this platform is consistent. In 2024, attackers chained CVE-2024-4879, CVE-2024-5178 and CVE-2024-5217 with publicly available exploits to breach private firms and government agencies worldwide [21]. Last month, according to BleepingComputer, ServiceNow privately disclosed an incident in which researchers or customer-led research used an unauthenticated access flaw in a vulnerable API endpoint to query data from customer instances [22]. Unauthenticated reach into instance data is the recurring shape here.
One detail for anyone on the Australia release train. The record for CVE-2026-18886 marks any version before Australia Patch 5 with a status of unknown, while the records for the other three mark that same version affected, and all four default to unaffected for releases the list does not name [19]. On that branch, the advisory does not tell you whether the image upload flaw reaches you.
