ServiceNow CVE-2026-74820
Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause
Risk & exploitation
Detection seeds: none indexed — public detection content (Sigma) that references this id; a seed is a starting point for a rule, not a verified fingerprint.
EPSS (FIRST) estimates a low likelihood of exploitation in the next 30 days (2026-10-11). Priority blends CVSS, EPSS, KEV and public-exploit availability — operational prioritization, not a NIS2/DORA reporting determination.
Summary
What it is. Someone who has never logged in can run SQL statements of their own against the database behind your instance, by tampering with the sort order on a request. ServiceNow rates it 10.0 out of 10 — the maximum — because it needs no credentials, no clicks, and the damage is not confined to the platform.
Are you exposed? Any Xanadu, Yokohama, Zurich or Australia instance that has not reached the patch levels listed below. For a direct answer, use the Check your instance link further down this page and enter your release and patch level.
On Washington DC or older, ServiceNow published no fix — it patches only releases still in support. That is not the same as being unaffected. No fixed version exists for those releases, so nothing on this page can clear you, and the instance should be treated as exposed until it is upgraded.
What to do. Patch. Direct statement execution against the database is not something an application-layer control can contain, and the flaw needs no login, so there is no configuration workaround to buy time with.
Has it been used? Not visibly. There is no CISA KEV entry, no public exploit in the sources tracked here, and ServiceNow reports no evidence of malicious exploitation. That is worth knowing and it is not a reason to wait: the CVE is days old, so nobody has been looking for long.
For analysts. ServiceNow's CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and SC:H/SI:H/SA:H, and the CWE is CWE-89. Sort-column injection is a well-known gap in otherwise parameterised code: bind parameters protect values, not identifiers, so a column name assembled from request input stays exposed after the rest of a query has been parameterised. ServiceNow scoring the impact as reaching subsequent systems is consistent with statements executing against the underlying database rather than with data disclosure alone.
What this page can tell you. The patch levels below were checked by a person against ServiceNow's KB3152244 on 2026-08-29, so the free check gives you a straight patched-or-affected answer from your release and patch level. Nobody has written a detection rule for this CVE yet, so the paid log check will tell you it could not look rather than guess — it never reports an attack it did not actually see.
Affected releases & fixed-in
| Release | Fixed in |
|---|---|
| Australia | Patch 2 Hot Fix 3 / Patch 3m / Patch 3 Hot Fix 2 / Patch 4 / Patch 5 |
| Zurich | Patch 7b Hot Fix 3 / Patch 8 Hot Fix 5 / Patch 9 Hot Fix 6 / Patch 10 Hot Fix 2m (m-branch) / Patch 10 Hot Fix 3 (standard) / Patch 11 / Patch 12 |
| Yokohama | Patch 12 Hot Fix 3b / Patch 13 Hot Fix 4 |
| Xanadu | Patch 11 Hot Fix 7a |
Source & attribution
Per-release fixed-in verified 2026-08-29 against ServiceNow KB3152244 ('August 2026 CVE Advisory Notification', login-gated, reviewed by a human) and cross-checked against the ServiceNow-authored CVE Record (CNA shortName: SN), https://cveawg.mitre.org/api/cve/CVE-2026-74820. The two sources agree on all four release families (Xanadu, Yokohama, Zurich, Australia). ServiceNow's CVE Records for this batch cite KB3152242; the article reviewed was KB3152244.
References
Data: GitHub Advisory Database (CC-BY 4.0), NVD, the CISA KEV catalog, FIRST EPSS, Exploit-DB, and Nuclei templates.