{"id":2250,"date":"2026-09-01T11:00:00","date_gmt":"2026-09-01T11:00:00","guid":{"rendered":"https:\/\/netguide.io\/news\/?p=2250"},"modified":"2026-09-01T11:00:00","modified_gmt":"2026-09-01T11:00:00","slug":"servicenow-drei-kritische-luecken-cvss-10","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/de\/2026\/09\/01\/servicenow-drei-kritische-luecken-cvss-10\/","title":{"rendered":"ServiceNow schlie\u00dft drei kritische L\u00fccken mit H\u00f6chstwert CVSS 10.0"},"content":{"rendered":"<div id=\"netgu-454672781\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\"><strong>ServiceNow hat am 27. August 2026 ein Sicherheitsupdate ver\u00f6ffentlicht, das drei Schwachstellen mit dem h\u00f6chstm\u00f6glichen Schweregrad von CVSS 10.0 schlie\u00dft. Alle drei lassen sich laut Hersteller unter bestimmten Umst\u00e4nden von unauthentifizierten Angreifern ausnutzen \u2013 ohne Zugangsdaten, ohne Nutzerinteraktion und \u00fcber das Netzwerk. Betroffen sind die weit verbreitete ServiceNow AI Platform und die Now Platform, die in zehntausenden Unternehmen als zentrale Workflow- und IT-Service-Management-Drehscheibe laufen.<\/strong><\/p>\n<h3 class=\"wp-block-heading\">Drei Wege zu Code, Daten und Datenbank<\/h3>\n<p class=\"wp-block-paragraph\">Die L\u00fccke CVE-2026-18885 erlaubt \u00fcber die GraphQL-Composite-Data-API die Ausf\u00fchrung beliebigen Codes. CVE-2026-18886 erm\u00f6glicht \u00fcber einen Upload von Konfigurationsbildern das unbefugte \u00c4ndern von Instanzdaten und eine Rechteausweitung. CVE-2026-74820 ist eine SQL-Injection, mit der sich beliebige SQL-Befehle gegen die zugrunde liegende Datenbank absetzen lassen. Zus\u00e4tzlich stopfte ServiceNow eine vierte Schwachstelle (CVE-2026-6876, CVSS 8.7), einen Sandbox-Ausbruch in der Now Platform. In Summe k\u00f6nnten Angreifer damit Instanzdaten auslesen, ver\u00e4ndern oder Berechtigungen umgehen.<\/p><div id=\"netgu-4187198410\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\n\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\n\t\n\t\t\t<ul class=\"deals-top__list\">\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/powera-zelda-tears-of-the-kingdom-switch-huelle-fuer-177e\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/Abbildung_2123779.jpeg-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">PowerA Zelda Tears of the Kingdom Switch H\u00fclle f\u00fcr 1,77\u20ac<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">1.77 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>12.99 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-86%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t13\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/diablo-iii-eternal-collection-nintendo-switch-inklusive-dlcs\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2835262_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Diablo III : Eternal Collection \u2013 Nintendo Switch inklusive DLCs<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">19.79 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>59.99 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-67%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t13\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/gmktec-nucbox-g10-mini-pc-amd-ryzen5-3500u-barebone\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2834157_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">GMKtec NucBox G10 Mini-PC AMD Ryzen5 3500U \u2013 Barebone<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">125.69 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>159.99 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-21%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t10\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/huawei-freebuds-neo-mit-rabatt-in-ear-kopfhoerer-fuer-10-e\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/2832899_1-150x150.webp\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">HUAWEI FreeBuds Neo mit Rabatt: In-Ear-Kopfh\u00f6rer f\u00fcr 10 \u20ac<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">10.00 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>129.00 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-92%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t4\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/2x-sonos-era-300-weiss-smart-home-tage-deal\/\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/era300_2-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\n\t\t\t\t\t\t\n\t\t\t\t\t\t<span class=\"deals-top__body\">\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">2x Sonos Era 300 Wei\u00df \u2013 Smart Home Tage Deal<\/span>\n\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">339.00 \u20ac<\/span>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>777.00 \u20ac<\/s>\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-56%<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t<\/span>\n\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\n\t\t\t\t\t\t\t4\u00b0\n\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/li>\n\t\t\t\t\t<\/ul>\n\n\t\t\t\t\t<p class=\"deals-top__more\">\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\n\t\t\t<\/p>\n\t\t\t<\/aside>\n<\/div>\n<h3 class=\"wp-block-heading\">Diese Releases m\u00fcssen gepatcht werden<\/h3>\n<p class=\"wp-block-paragraph\">ServiceNow hat die gehosteten Instanzen bereits selbst aktualisiert. Self-Hosted-Kunden und Partner m\u00fcssen dagegen manuell t\u00e4tig werden. Betroffen sind unter anderem folgende Release-Zweige:<\/p>\n<ul class=\"wp-block-list\"><li>Xanadu vor Patch 11 Hot Fix 7a<\/li><li>Yokohama vor Patch 12 Hot Fix 3b bzw. Patch 13 Hot Fix 4<\/li><li>Zurich vor den jeweils aktualisierten Builds (u. a. Patch 7b Hot Fix 3)<\/li><li>Australia vor Patch 2 Hot Fix 3<\/li><\/ul>\n<h3 class=\"wp-block-heading\">Noch keine Ausnutzung \u2013 aber die Uhr tickt<\/h3>\n<p class=\"wp-block-paragraph\">ServiceNow erkl\u00e4rte, bislang keine Kenntnis von aktiver Ausnutzung zu haben; \u00f6ffentlicher Exploit-Code f\u00fcr die drei 10.0-L\u00fccken ist ebenfalls nicht bekannt. Sicherheitsexperten warnen jedoch: Bei einer derart kritischen, unauthentifiziert ausnutzbaren Angriffsfl\u00e4che ist mit Reverse-Engineering der Patches und schneller Exploit-Entwicklung zu rechnen. Administratoren sollten die relevanten Hot Fixes umgehend einspielen und ihre Instanzen auf verd\u00e4chtige Zugriffe pr\u00fcfen.<\/p>\n<p class=\"wp-block-paragraph\"><em>Quellen: <a href=\"https:\/\/www.servicenow.com\/community\/security-incident-response-articles\/\" target=\"_blank\" rel=\"noopener\">ServiceNow Security Advisory<\/a>, <a href=\"https:\/\/thehackernews.com\/2026\/08\/three-cvss-100-servicenow-flaws-could.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a>, <a href=\"https:\/\/www.csoonline.com\/article\/4215430\/servicenow-patches-three-maximum-severity-flaws-that-could-put-enterprise-data-at-risk.html\" target=\"_blank\" rel=\"noopener\">CSO Online<\/a>.<\/em><\/p><div id=\"netgu-2190750355\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>ServiceNow hat drei Schwachstellen mit dem Maximalwert CVSS 10.0 in seiner AI- und Now-Plattform gepatcht. Unauthentifizierte Angreifer k\u00f6nnten Code ausf\u00fchren und Datenbanken manipulieren \u2013 ein Notfall f\u00fcr zehntausende Enterprise-Instanzen.<\/p>\n","protected":false},"author":1,"featured_media":1722,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-2250","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=2250"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2250\/revisions"}],"predecessor-version":[{"id":2258,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2250\/revisions\/2258"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1722"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=2250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=2250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=2250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}