Read the docs
TI-2026-15448 Aliases CVE-2026-18886GHSA-f8mv-7pgv-hmrg

Unauthenticated Privilege Escalation via System Configuration Image Upload Processor

Priority MEDIUM 57CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

ServiceNow has remediated an improper access control vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to create or modify instance data beyond what was intended, resulting in privilege escalation.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05041 92nd percentileScored 2026-11-07
Fix Fixed ServiceNow AI Platform (ServiceNow): Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b, Yokohama Patch 13 Hot Fix 4 +12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ServiceNowServiceNow AI Platformbefore Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 12 Hot Fix 3b; before Yokohama Patch 13 Hot Fix 4; before Zurich Patch 7b Hot Fix 3; before Zurich Patch 8 Hot Fix 5; before Zurich Patch 9 Hot Fix 6; before Zurich Patch 10 Hot Fix 2m (m-branch); before Zurich Patch 10 Hot Fix 3 (standard); before Zurich Patch 11; before Zurich Patch 12; before Australia Patch 2 Hot Fix 3; before Australia Patch 3 Hot Fix 2; before Australia Patch 3m; before Australia Patch 4; before Australia Patch 5Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b, Yokohama Patch 13 Hot Fix 4, Zurich Patch 7b Hot Fix 3, Zurich Patch 8 Hot Fix 5, Zurich Patch 9 Hot Fix 6, Zurich Patch 10 Hot Fix 2m (m-branch), Zurich Patch 10 Hot Fix 3 (standard), Zurich Patch 11, Zurich Patch 12, Australia Patch 2 Hot Fix 3, Australia Patch 3 Hot Fix 2, Australia Patch 3m, Australia Patch 4, Australia Patch 5Patch availableCNA
  • ServiceNow AI Platform VendorServiceNow Affected before Xanadu Patch 11 Hot Fix 7a; before Yokohama Patch 12 Hot Fix 3b; before Yokohama Patch 13 Hot Fix 4; before Zurich Patch 7b Hot Fix 3; before Zurich Patch 8 Hot Fix 5; before Zurich Patch 9 Hot Fix 6; before Zurich Patch 10 Hot Fix 2m (m-branch); before Zurich Patch 10 Hot Fix 3 (standard); before Zurich Patch 11; before Zurich Patch 12; before Australia Patch 2 Hot Fix 3; before Australia Patch 3 Hot Fix 2; before Australia Patch 3m; before Australia Patch 4; before Australia Patch 5 Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b, Yokohama Patch 13 Hot Fix 4, Zurich Patch 7b Hot Fix 3, Zurich Patch 8 Hot Fix 5, Zurich Patch 9 Hot Fix 6, Zurich Patch 10 Hot Fix 2m (m-branch), Zurich Patch 10 Hot Fix 3 (standard), Zurich Patch 11, Zurich Patch 12, Australia Patch 2 Hot Fix 3, Australia Patch 3 Hot Fix 2, Australia Patch 3m, Australia Patch 4, Australia Patch 5 Patch available CNA

Remediation

  • Fix · CNA ServiceNow AI Platform (ServiceNow) Fixed in Xanadu Patch 11 Hot Fix 7a, Yokohama Patch 12 Hot Fix 3b, Yokohama Patch 13 Hot Fix 4, Zurich Patch 7b Hot Fix 3, Zurich Patch 8 Hot Fix 5, Zurich Patch 9 Hot Fix 6, Zurich Patch 10 Hot Fix 2m (m-branch), Zurich Patch 10 Hot Fix 3 (standard), Zurich Patch 11, Zurich Patch 12, Australia Patch 2 Hot Fix 3, Australia Patch 3 Hot Fix 2, Australia Patch 3m, Australia Patch 4, Australia Patch 5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    ServiceNow AI Platform Australia Patch 2 Hot Fix 3, Australia Patch 3 Hot Fix 2 and 13 more versions

    4 records Highest priority Priority MEDIUM 4 MEDIUM

    Other records, highest priority first

    • TI-2026-15447 Unauthenticated Remote Code Execution in GraphQL Composite Data APIPriority MEDIUM 59
    • TI-2026-52569 Unauthenticated SQL Injection via Dynamic Schema ORDER BY ClausePriority MEDIUM 57
    • TI-2026-06032 Sandbox Escape in ServiceNow AI PlatformPriority MEDIUM 44
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-18886
  2. 2026-10-03 Alias added: GHSA-f8mv-7pgv-hmrg

References

Other 1

  • TI-2024-04841 Incomplete Input Validation in GlideExpression Script KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-04536 Jelly Template Injection Vulnerability in ServiceNow UI Macros KEVCVSS 4.0CRITICAL 9.3
  • TI-2025-11396 Unauthenticated Privilege Escalation in ServiceNow AI Platform CVSS 4.0CRITICAL 9.3
  • TI-2026-15447 Unauthenticated Remote Code Execution in GraphQL Composite Data API CVSS 4.0CRITICAL 10.0
  • TI-2026-52569 Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause CVSS 4.0CRITICAL 10.0
  • TI-2024-04807 Incomplete Input Validation in SecurelyAccess API CVSS 4.0MEDIUM 6.9
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences