{"uuid": "7936712e-068d-4d25-bec4-5e0c94516b83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18886", "type": "seen", "source": "https://t.me/CyberDispatch/2773", "content": "The first of the critical bugs, tracked as CVE-2026-18885, allows an attacker to execute arbitrary code in the ServiceNow platform under certain circumstances.\n\nAn attacker could exploit the weakness to gain access to and potentially modify arbitrary data, ServiceNow notes in its advisory.\n\nThe second critical defect, CVE-2026-18886, is described as an improper access control issue. It could allow an attacker to create or modify arbitrary data and elevate their privileges.\n\nTracked as CVE-2026-74820, the third critical vulnerability is an SQL injection flaw that allows an attacker to execute arbitrary SQL statements against the underlying ServiceNow database.", "creation_timestamp": "2026-09-03T21:00:29.168437Z"}