ServiceNow CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820: CVSS 10.0 flaw exploited

Researchers grouped three ServiceNow flaws — CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 — into one warning with a maximum CVSS score of 10.0 and reports of active exploitation. Fixes for self-hosted instances are branch-specific hot fixes, so there is no single patched version number.

• Three ServiceNow CVEs carry the maximum CVSS score of 10.0
• Border Cyber Group reports active exploitation, not theoretical risk
• Hot fixes depend on the release branch, so no single version number applies
• Admins should audit new accounts, integrations and jobs over 30 days