AI AgentsVulnerability ManagementAI Security
A CVSS score of 10.0 is rare. Most "critical" vulnerabilities land somewhere in the nines, because something in the vector pulls the number down — the attacker needs a foothold, or user interaction, or the damage stops at the vulnerable component.
On August 27, 2026, ServiceNow published four CVEs and three of them were 10.0s.
ORDER BY clause.All three tens are exploitable by unauthenticated attackers, at low complexity, with no user interaction. ServiceNow states in each record that it is not currently aware of exploitation. Affected releases span Xanadu, Yokohama, Zurich and Australia; customers in the ServiceNow Patching Program have already received the fix automatically, while self-hosted customers have to apply it themselves.
Patch them. That part is not interesting.
What is interesting is why they scored 10.0, and what the platform they landed in is now being used for.
The three maximum-severity flaws share identical CVSS metrics, and the phrase doing the work is that they have high impact to confidentiality, integrity and availability in both the vulnerable component and the systems connected to it.
That is the scope metric — the part of CVSS that asks whether compromising this thing gets you something else. It is the single hardest metric to earn, and it is why these are tens rather than nines.
CVSS is, for once, telling you something precise: the severity is not a property of ServiceNow's code. It is a property of ServiceNow's position. This is the system holding the CMDB, the integration credentials, the HR records, the change approvals and the service accounts into everything else you run. A pre-auth RCE there is not a ticketing incident. It is a credential incident in every system the platform can reach.
Most triage flattens that distinction away. A finding arrives, it says "Critical, 10.0", it goes to the top of the queue, and the queue is about patching the component. The metric that produced the ten — everything downstream — never becomes anyone's action item.
There is a reason to take the fourth CVE, the merely-8.7 one, seriously.
On April 1, 2026, Searchlight Cyber reported a sandbox escape in the ServiceNow AI Platform, tracked as CVE-2026-6875. ServiceNow patched it. On July 18, exploitation in the wild began, confirmed the following day, against the pre-authentication endpoint /assessment_thanks.do — and notably, the payloads observed in the wild used a sandbox-escape route different from the published proof-of-concept. Attackers did not copy the PoC. They found their own way out of the same sandbox.
CVE-2026-6876, disclosed six weeks later, is another sandbox escape in the same platform.
We wrote about this failure mode five days ago in a different context: a sandbox is a security boundary only if it was designed as one and only until someone finds a gadget through it. The relevant history here is that this specific boundary, in this specific product, was escaped by real attackers six weeks ago using a technique nobody had published. Treating the new one as lower priority because its number starts with an 8 is the same reasoning that cost teams seven weeks on Citrix.
ServiceNow renamed the Now Platform to the ServiceNow AI Platform. It would be lazy to read the three tens as "AI code is insecure" — a GraphQL injection, an image-upload access-control bug and a SQL ORDER BY flaw are classic web application vulnerabilities that have nothing to do with models. The rename did not cause them.
The rename does, however, describe what the platform is now doing. ServiceNow's AI annual contract value crossed $1 billion in Q2 2026, and the number of customers running agentic AI in production grew ninefold over nine months. Those agents run inside the platform, on the platform's identity, with the platform's reach — resolving tickets, updating the CMDB, provisioning access, calling integrations.
So the "systems connected to it" that produced the 10.0 rating are no longer a fixed list of integrations that a person configured and someone reviewed. They are a growing set of automated actions taken on standing credentials, at a volume no one is reading line by line.
That is the actual change in blast radius. The vulnerability class is old. The thing behind the vulnerability is new, and it got there in nine months.
/assessment_thanks.do POST traffic is the thing to go looking for.Obiguard does not patch ServiceNow. Nothing we ship would have prevented a SQL injection in an ORDER BY clause, and it would be dishonest to imply otherwise.
What Governance AI addresses is item 4 on that list — the part of the blast radius that is made of AI agents and standing credentials, and that grew ninefold in nine months while the vulnerability-management process stayed the same shape.
Permissions are positive, not inferred. Allow-lists bind each credential to specific model IDs, tools, external domains and invoking identities. Any call outside the approved list is blocked and written to the audit ledger automatically. The distinction matters here because the threat model is an attacker operating as a legitimate agent identity: detection asks whether the behaviour looked odd, while a positive permission list makes the unlisted destination a denial regardless of how plausible the request looked. That is least privilege expressed as configuration rather than as an intention.
Policy runs before the call leaves. The inspection layer applies each workload's policy set to every request — PII and PCI redaction, block-lists, jailbreak and prompt-injection detection — so an agent that has been redirected does not get to exfiltrate through its own sanctioned model connection. Violations needing human judgement route to the Review Queue, where a person assigns, annotates, approves or escalates before the action stands.
The reach list exists as an artefact, not as tribal knowledge. The audit ledger keeps an immutable per-call record of prompt, response, tool calls, model and initiating identity, streaming to Splunk, Sumo Logic or Datadog. When the question is question 3 and 4 above — what could this have touched, and what did it actually touch — that is a query rather than a reconstruction. And framework mapping carries the same controls into NIST AI RMF and ISO/IEC 42001 evidence, which is the form the question takes when it arrives from an auditor instead of from an incident.
On the vulnerability side, Obiguard SOC is the half that keeps the finding alive after triage: CVE Radar scans on every push and daily, and Threat Intelligence cross-references findings against CISA KEV and FIRST.org EPSS on a schedule — so if CVE-2026-6876 follows its predecessor into active exploitation, that is a change surfaced against your estate rather than a headline you have to catch. Dismissing a finding requires a comment recorded to your organisation, which is how "we deprioritised the 8.7" stays a decision with a name on it.
Read the CVSS vector again. Three tens, earned on the strength of impact to connected systems.
That metric was designed for a world where "connected systems" meant a documented list of integrations, assembled by hand, reviewed at architecture board, and changing a few times a year. It is a reasonable proxy for blast radius under those conditions.
It is no longer a reasonable proxy. The platform that scored those tens has been quietly acquiring a second population of connected systems — agent-initiated, credential-bearing, growing ninefold in nine months — and none of that is visible to the scanner that reports the 10.0, or to the ticket that closes when the patch lands.
The score is right. The number underneath it is bigger than the score knows, and it is bigger this quarter than it was last quarter, and nobody is measuring the delta.
Explore Governance AI or talk to us about what your AI agents can currently reach on credentials nobody has reviewed since deployment.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →