> TritonInfoSec News
Home / Aug 29, 2026 / Story
0
#5 The Hacker News general August 28, 2026 at 11:20 UTC

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL

By [email protected] (The Hacker News)

AI Summary

ServiceNow patched four vulnerabilities in its AI Platform, three rated CVSS 10.0, enabling unauthenticated attackers to perform code injection, SQL injection, and privilege escalation under certain conditions. The company deployed fixes to hosted instances and issued updates to partners and self-hosted customers, but organizations running self-hosted deployments must manually apply patches. Given the maximum severity rating and the broad enterprise deployment of ServiceNow, this warrants immediate patching priority.

Read full article → https://thehackernews.com/2026/08/three-cvss-100-s…

Relevance score: 84.0/100

# More from August 29

  1. 1
    McKesson discloses breach after ShinyHunters claims patient data theft BleepingComputer
  2. 2
    Two Alleged ‘TeamPCP’ Hackers Arrested in Australia Krebs on Security
  3. 3
    PaperCut releases second emergency patch for exploited flaws BleepingComputer
  4. 4
    Hundreds of OpenAI Agents Invaded Hugging Face Servers Dark Reading
  5. 6
    ownCloud Flaw Exploited to Steal Nuclear Records From Philippine Research Body The Hacker News
  6. 7
    ATF confirms cyberattack hit system containing info on its investigation targets CyberScoop
  7. 8
    China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access The Hacker News
  8. 9
    APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations The Hacker News
  9. 10
    19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code The Hacker News