ServiceNow CVE-2026-18886

What it is. Someone who has never logged in can create or alter data inside your instance through the system-configuration image upload processor, and come away with privileges they were never granted. ServiceNow rates it 10.0 out of 10 — the maximum.

Are you exposed? Any Xanadu, Yokohama, Zurich or Australia instance that has not reached the patch levels listed below. For a direct answer, use the Check your instance link further down this page and enter your release and patch level.

On Washington DC or older, ServiceNow published no fix — it patches only releases still in support. That is not the same as being unaffected. No fixed version exists for those releases, so nothing on this page can clear you, and the instance should be treated as exposed until it is upgraded.

What to do. Patch. Note that the way in is a file-upload path rather than a query interface, so an instance that restricts inbound API traffic may still be reachable through ordinary configuration workflows — narrowing API exposure is not a substitute here.

Has it been used? Not visibly. There is no CISA KEV entry, no public exploit in the sources tracked here, and ServiceNow reports no evidence of malicious exploitation. That is worth knowing and it is not a reason to wait: the CVE is days old, so nobody has been looking for long.

For analysts. ServiceNow's CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and SC:H/SI:H/SA:H — no credentials, no interaction, and impact assessed as reaching subsequent systems. The CWE assigned downstream is CWE-284, improper access control.

Vendor sources disagree on the flaw class. ServiceNow KB3152244 calls this a code injection vulnerability. ServiceNow's own CVE Record for the same CVE calls it improper access control, which is what the downstream CWE-284 reflects. Both describe the same outcome — unauthenticated creation or modification of instance data leading to privilege escalation — and both give the same patch levels, so it changes nothing about what to install. The class shown on this page follows the CWE and the CVE Record. Open question: needs ServiceNow follow-up.

What this page can tell you. The patch levels below were checked by a person against ServiceNow's KB3152244 on 2026-08-29, so the free check gives you a straight patched-or-affected answer from your release and patch level. Nobody has written a detection rule for this CVE yet, so the paid log check will tell you it could not look rather than guess — it never reports an attack it did not actually see.