# ServiceNow issues patches for three CVSS 10 code-injection flaws

_Published Monday, August 31, 2026 at 11:18 AM EDT · Security · Latest · Tier 1 — Major_

![ServiceNow issues patches for three CVSS 10 code-injection flaws — Primary](https://www.securityweek.com/wp-content/uploads/2026/06/ServiceNow.webp)

ServiceNow said it has deployed patches across hosted instances and released hotfixes for self-hosted deployments after disclosure of four vulnerabilities in its AI platform and Now Platform. Three flaws, rated CVSS 10, allow code execution, arbitrary data changes or arbitrary SQL statements in low-complexity attacks without authentication or user interaction. A fourth, rated 8.7, is a sandbox-escape issue that can enable code execution. The self-hosted hotfixes cover the Xanadu, Yokohama, Zurich and Australia releases.

## Sources

- [SecurityWeek](https://www.securityweek.com/servicenow-patches-3-critical-code-injection-vulnerabilities/)

---
Canonical: https://techandbusiness.org/newswire/ylSGZNL3eaUJMM3cemU36r
Published: 2026-08-31T15:18:30.246Z
Story chronology: 2026-08-31T13:59:19.000Z
Retrieved: 2026-10-15T23:01:50.744Z
Publisher: Tech & Business (techandbusiness.org)