ServiceNow CVE-2026-18885

What it is. Someone who has never logged in to your instance can make it run code of their choosing, through its GraphQL Composite Data API. ServiceNow rates it 10.0 out of 10 — the maximum — because it needs no credentials, no user interaction, and nothing to go the attacker's way beyond reaching the endpoint.

Are you exposed? Any Xanadu, Yokohama, Zurich or Australia instance that has not reached the patch levels listed below. For a direct answer, use the Check your instance link further down this page and enter your release and patch level.

On Washington DC or older, ServiceNow published no fix — it patches only releases still in support. That is not the same as being unaffected. No fixed version exists for those releases, so nothing on this page can clear you, and the instance should be treated as exposed until it is upgraded.

What to do. Patch. There is no configuration change that mitigates a flaw needing no login — a fixed version is the only fix. ServiceNow updated the instances it hosts; self-hosted and partner-run instances need the update applied.

Has it been used? Not visibly. There is no CISA KEV entry, no public exploit in the sources tracked here, and ServiceNow reports no evidence of malicious exploitation. That is worth knowing and it is not a reason to wait: the CVE is days old, so nobody has been looking for long.

For analysts. ServiceNow's CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and SC:H/SI:H/SA:H. The second impact triple is what takes it to a full 10.0 rather than a high 9: ServiceNow assessed the consequences as landing on subsequent systems, so the blast radius is judged to cross the instance boundary rather than stop at the component that failed. Downstream sources classify it as CWE-94, code injection. Fixes shipped on four release families at once, the oldest being Xanadu, so the defect has been present at least as far back as that line.

What this page can tell you. The patch levels below were checked by a person against ServiceNow's KB3152244 on 2026-08-29, so the free check gives you a straight patched-or-affected answer from your release and patch level. Nobody has written a detection rule for this CVE yet, so the paid log check will tell you it could not look rather than guess — it never reports an attack it did not actually see.