Build1 distinct publisher2 min readPublished
The writeup lists three conditions that all have to hold for exploitation, and an instance that answers on the public internet already satisfies the first, leaving only the hotfix and the WAF rules standing between exposure and exploit -- which is why this is a same-day hotfix, not a sprint ticket.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
ORDER BY is where parameterised queries stop covering you. A bind parameter carries a value, not a column name or a sort direction, because the identifier has to sit in the statement text before the planner touches it. Any feature that lets the caller pick the sort column therefore needs an allowlist of names, and a dynamic schema feature has a long list to check against. That is the shape the writeup describes for CVE-2026-74820 [4]. In that class of bug the fix lives in the query builder's input validation, not in the SQL.
A CVSS 10.0 is a statement about a flaw under worst-case assumptions. The part of this material that describes your deployment is the precondition list: network reachability to the vulnerable environment, the applicable hotfix not installed, and WAF or API controls that do not block the crafted requests [9]. All three have to hold. For an instance that answers on the public internet the first is already true, which leaves two [18]. One of those two is a hotfix you can install and verify [10]. The other asks your WAF to recognise a request the summary never describes.
Four CVE identifiers appear in the material and three carry a stated 10.0, which leaves the sandbox escape into the Now Platform without a published score here [17]. Sourcing is correspondingly thin: a dev.to summary crediting SecurityWeek, with ServiceNow's August 2026 advisory and BleepingComputer listed as related sources rather than quoted [16]. Affected release versions and hotfix identifiers are not in it. Active exploitation was not observed at publication [11], which reports what the writer could see, not what your own logs show.
The detection guidance divides along the hosting line. Endpoint telemetry (suspicious child processes of ServiceNow, file creation, script execution) is offered only for self-hosted instances [13]. On a ServiceNow-hosted instance what you have instead is the instance's own execution history for GraphQL calls, image uploads, audits, data changes, role changes and IntegrationHub [15], plus the identity signal of a new high-privilege user, role assignment or integration credential use immediately following an unauthenticated request [14]. The rest of the clue list is request-shaped: abnormal GraphQL calls, configuration image uploads, ORDER BY errors [12]. Enabling auditing for those is the last item on the remediation list [10]. Turning on auditing today gives you visibility going forward, not into last Tuesday.
Two steps hide inside the first item on that same list: apply the hotfix, and verify the patched version [10]. Verification is per instance. Any sub-production instance that still answers on the internet meets the same three preconditions as the one your users log into [9].
Ranked by verification strength, evidence, and original report placement.
A dev.to writeup summarising SecurityWeek reporting published 2026-08-31 states that ServiceNow patched three unauthenticated CVSS 10.0 vulnerabilities in the ServiceNow AI Platform (code injection in the GraphQL Composite Data API, an access control flaw in configuration image upload processing, and SQL injection in dynamic schema ORDER BY clauses) along with an unauthenticated sandbox escape.
CVE-2026-18885 causes code injection in the GraphQL Composite Data API.
CVE-2026-18886 exploits an access control flaw in configuration image upload processing to create and modify data and escalate privileges.
CVE-2026-74820 injects SQL into dynamic schema ORDER BY clauses to manipulate the underlying database.
CVE-2026-6876 escapes the sandbox to execute code within the Now Platform.
The attacker profile is an unauthenticated external attacker with network access to the HTTP(S) endpoint of the ServiceNow instance; exploitation requires no authentication and no user interaction.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 31, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
security
Self-hosted ServiceNow operators inherit three unauthenticated CVSS 10.0 flaws to patch themselves2 distinct publishers
build
An unwhitelisted JDBC driver name turns PaperCut's management port into SYSTEM1 distinct publisher
security
A Massachusetts filing puts 436 names on Hasbro's unexplained March breach2 distinct publishers
security
Certighost turns a domain user into a Domain Controller, and the patch is only step one1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Specific, coherent, uncorroborated
Four CVE numbers, three maximum severity ratings and a clean privilege model all reach us through a single dev.to digest of SecurityWeek. ServiceNow's August advisory is named and never quoted, no affected or fixed build appears anywhere, and the fourth flaw arrives with no score at all. The technical account is internally consistent and specific enough to act on — which is not the same as verified.
Fix shipped, uptake invisible
A hotfix exists — that is the entirety of what can be seen. Nobody counts internet-facing instances, nobody reports patch rates, and the only telemetry statement in the whole piece is a negative: no exploitation observed. Vendor action is not uptake, so we decline to put a number on it.
Severity number outruns the observation
"Three CVSS 10.0" is doing more work in the framing than the body can bear: a rating is a rating, not an incident, and the same text concedes nothing has been seen in the wild and that three conditions must hold together. Our own dek then argues for a same-day hotfix — defensible, since an internet-facing instance already meets the first condition, but the drumbeat still runs slightly ahead of a single secondhand summary.
Aggregator restating a vendor's fix
No product is being sold here and no researcher is claiming credit; dev.to's author is repackaging someone else's report, and the pull is toward a striking number in the title and toward volume — long detection lists read as thorough whether or not any of it was tested. ServiceNow's interest sits one link upstream: the story arrives pre-framed as already patched, with no exposure figures attached.
One voice, checkable but unchecked
We would bet on the shape of this — four flaws, patched, unauthenticated, no exploitation yet — and much less on the particulars, because a single publisher restating another leaves every number a copy of a copy. The primary advisory is cited by name, which means the facts are verifiable in principle; nothing in our coverage verifies them in practice.