CVE-2026-18886

CVE-2026-18886 is an improper access control vulnerability (CWE-284) in the ServiceNow AI Platform that, in certain circumstances, allows an unauthenticated remote user to create or modify instance data beyond what was intended. Because the flaw is reachable over the network with no privileges or user interaction required, an attacker who meets the advisory's conditions can manipulate instance data and achieve privilege escalation. Successful exploitation carries high impact to the confidentiality, integrity, and availability of the affected instance (CVSS 4.0 score of 10.0). Customers running affected ServiceNow AI Platform releases are potentially affected; ServiceNow has already deployed the security update to hosted instances, while self-hosted customers and partners must apply the provided update themselves. No exploitation has been observed to date (EPSS 0.2%, not listed in CISA KEV, no public proof-of-concept).

What to do: Self-hosted customers and partners should promptly apply the ServiceNow-provided security update or upgrade to a patched release, and hosted-instance administrators should verify their instance is running the patched build. Given the unauthenticated network vector and CVSS 4.0 score of 10.0, prioritize this patch even though no exploitation or public PoC is known. Monitor ServiceNow's advisory for updated guidance and indicators.