Three independent CVSS 10.0 vulnerabilities disclosed in ServiceNow’s AI Platform on Wednesday represent the second critical security advisory for the product in five weeks – and the first to expose how AI agent workflows amplify the blast radius of infrastructure flaws in enterprise environments.
The KB3152242 advisory, published August 27, discloses three unauthenticated, zero-interaction vulnerabilities in ServiceNow AI Platform: a code injection flaw (CVE-2026-18885), an access control bypass (CVE-2026-18886), and a SQL injection vulnerability (CVE-2026-74820). Each carries the maximum severity score. None requires credentials. None requires user interaction. All three are remotely exploitable in default configurations.
For organizations using ServiceNow AI Platform to power internal AI agents – routing helpdesk tickets, querying knowledge bases, triaging incidents – the advisory is not just a patching exercise. It is an architectural question about how deeply agents inherit the security posture of the platforms they connect to.
The Three Flaws
CVE-2026-18885, the code injection vulnerability, allows an unauthenticated attacker to execute arbitrary code on the ServiceNow AI Platform instance. The advisory does not disclose the specific injection point, but the CVSS vector – network-adjacent, low attack complexity, no privileges required – indicates a direct exploitation path. Code injection in a platform that runs AI agent orchestration is structurally different from code injection in a traditional web application: the platform holds session context, tool configurations, and credentials that agents use to act on behalf of users.
CVE-2026-18886, the access control bypass, removes the authorization boundary entirely for certain operations. An unauthenticated requester can invoke functionality that should require elevated privileges. In a platform designed to execute business logic through agent workflows, an access control bypass does not just expose data – it exposes the ability to trigger actions.
CVE-2026-74820, the SQL injection vulnerability, gives an attacker direct access to the backing database. In isolation, SQL injection is a known and manageable class. In the context of an AI platform, the database contains not just application data but potentially conversation histories, tool configurations, authentication tokens cached for agent use, and the knowledge base content that agents rely on for decision-making.
The Agent Amplification Effect
What distinguishes this advisory from the CVE-2026-6875 disclosure five weeks ago is the implied attack surface expansion. CVE-2026-6875 was a pre-authenticated remote code execution flaw that threatened ServiceNow instances directly. KB3152242 threatens the AI layer that sits on top of them.
Organizations deploying AI agents on ServiceNow’s platform typically grant those agents broad access: the ability to read and write records, trigger workflows, escalate tickets, query connected data sources, and in some configurations, execute scripts. When an agent inherits its access from a platform that is compromised through one of these three CVEs, the attacker does not need to compromise the agent separately. They compromise the platform and the agent comes free.
This is the agent amplification effect, and it is becoming a recurring structural concern. The Langflow CVE-2026-55255 chain demonstrated the same dynamic in July: attackers chained an IDOR with a prior RCE to harvest cloud credentials and LLM provider keys from instances that agents relied on. The MCP stateless shift amplified it further by removing server-side session state, meaning every request carries its own authentication context and every request becomes an injection point.
Five Weeks Between Advisories
Two critical advisories in five weeks is not unusual for enterprise software vendors under active testing. What is notable is the pattern of unauthenticated, zero-interaction vulnerabilities in the AI-specific layer of the platform. CVE-2026-6875 required no authentication. All three CVEs in KB3152242 require no authentication. The cumulative effect is that organizations running ServiceNow AI Platform have been asked to patch maximum-severity unauthenticated RCEs twice in just over a month.
ServiceNow’s advisory assigns each CVE a separate fix. Organizations need to update to the latest AI Platform release and verify that all three patches are applied. Given that the three vulnerabilities are independent – code injection, access control, and SQL injection are distinct failure classes – patching one does not address the others.
What Security Teams Should Do
Three immediate steps:
- Patch immediately. All three CVEs are remotely exploitable with no authentication. The zero-interaction requirement means no user action is needed for exploitation. Apply the KB3152242 update and verify each CVE is addressed.
- Audit agent permissions. If AI agents connected to ServiceNow have been granted broad operational access, review what those agents can reach and execute. Assume the platform was exposed to unauthenticated access for the window between advisory publication and patching.
- Check for post-exploitation indicators. Code injection and SQL injection both produce observable traces – unexpected process execution, unusual database queries, outbound network connections. Review logs for the period between the advisory publication and patch deployment.
For the broader enterprise AI ecosystem, the pattern continues to tighten. ChatMate’s RPE flaw exposed telephony-connected MCP servers. Langflow’s chaining pattern showed how attackers harvest credentials through AI tooling. ServiceNow’s second advisory in five weeks reinforces the core concern: AI agent platforms are inheriting the full attack surface of the infrastructure they connect to, and the vulnerabilities are arriving faster than the security posture is maturing.
The question for organizations is no longer whether AI agent infrastructure is a viable attack surface. It is how many independent maximum-severity flaws their agent platforms can accumulate before the defending team falls behind the exploiting one.