The IT Nerd

Four flaws hand just been disclosed in ServiceNow’s AI Platform, three of them scored a maximum CVSS 10.0: a code injection bug in the GraphQL Composite Data API (CVE-2026-18885), a privilege escalation flaw in the system configuration image upload processor (CVE-2026-18886), and a SQL injection through a dynamic schema ORDER BY clause (CVE-2026-74820), plus a lower-severity sandbox escape in the Now Platform (CVE-2026-6876, CVSS 8.7). ServiceNow patched its own hosted instances on August 27, but self-hosted customers must apply the fix themselves, leaving the responsibility for closing three maximum-severity holes with the customer rather than the vendor.

Jason Brown, Director of Counter Fraud Operations, iCOUNTER had this to say:

“Three maximum severity bugs in one disclosure is a lot, but the detail I’d focus on is the split between hosted and self hosted customers. ServiceNow’s hosted instances were already updated as part of the August 27 advisory. Everyone running ServiceNow on their own infrastructure now has to go find, schedule, and apply that patch themselves, and in a lot of organizations that process takes weeks, not days. During those weeks, an unauthenticated attacker with a working exploit for the GraphQL Composite Data API code injection bug or the SQL injection flaw has a real shot at systems that sit next to HR records, vendor onboarding, and finance approvals. I spent years chasing fraud operators who specifically target that lag between disclosure and patch adoption, because they know it’s where the easy access is. My advice to any security team running ServiceNow self hosted right now is simple: don’t wait for your normal patch cycle, treat this one as urgent and confirm it’s applied this week.”

Needless to say, if you use ServiceNow, it’s time to patch all the things. And maybe at the same time take a look at how ServiceNow is used in your organization.

ServiceNow today announced an acceleration of its Autonomous Security vision with six unified solutions that help deliver prevention-first, AI-native cyber defense across unified exposure management, continuous vulnerability detection, cyber-physical security, identity and access security, and agentic incident response, and cyber risk and compliance. With new AI Specialists that complete security workflows autonomously, including the Vulnerability Resolution AI Specialist, these capabilities enable enterprises to prevent, contain, and remediate risk at machine speed, before threats become breaches.

As enterprises adopt agentic AI, security teams face an emerging challenge: every new agent, identity, and line of code multiplies exposure faster than any human team, or any patchwork of disconnected tools, can respond to. Closing that gap requires governed autonomy at the same machine speed. The average enterprise runs more than 70 security tools, fragmenting insights across the extended attack surface, including endpoints, networks, cloud environments, and identities. Today, ServiceNow becomes one of the most complete and fastest-growing security companies built for the AI era by consolidating this complexity into one unified system where assets, identities, and agents are visible, contextualized, secured, governed and auditable in a single motion.

This is achievable through Shift Zero: the move from fragmented, reactive security to prevention embedded at every layer, where every system, identity, and agent is governed and secured in real-time as threats move at AI speed. In Shift Zero, the goal is zero exposure at all times with an enterprise able to answer, with proof, what every system is doing, why, and who is accountable, while AI moves as fast as the business needs it to.

Shift Zero: Prevention embedded at every layer

Autonomous Security moves companies from reactive, fragmented security to prevention-first, autonomously governed security that operates faster than AI creates risk. The Autonomous Security offerings stand on six solutions that integrate into ServiceNow’s AI Control Tower.

Unified Exposure Management: Exposures pile up in silos, with security teams seeing vulnerabilities but not the assets that matter or which ones could be easily exploited. ServiceNow consolidates findings from any source and enriches data with business context and exploitation intelligence, enabling autonomous remediation at scale.

• Agentic Exposure Management consolidates vulnerability findings from every source into a single stream enriched by Early Warning threat intelligence and Fix Intelligence prioritized remediation.
• Vulnerability Resolution AI Specialist orchestrates triage and remediation at enterprise scale, executes low-risk patches, and turns exposure backlogs into closure pipelines.

Continuous Vulnerability Detection: The attack surface spans code, cloud, and infrastructure, but traditional tools only see one layer at a time. ServiceNow closes these gaps, enabling security teams to govern code, cloud, and infrastructure risks from a unified platform.

• Application Security extends threat modeling to AI-generated code and model dependencies with a new version that surfaces supply chain vulnerabilities before deployment.
• Dynamic Application Security Testing (DAST) validates runtime vulnerabilities in live applications and APIs.
• External Attack Surface Management (EASM) surfaces infrastructure exposure that attackers can exploit, showing a footprint the way threat actors see it.

Cyber-Physical Security: OT, medical devices, and IoT systems can be blind spots because legacy tools disrupt production and lack the behavioral understanding needed to catch risky activity. ServiceNow brings continuous visibility and compliance monitoring to operational environments without disruption.

• Agentic AI for Cyber Physical Security delivers agentless discovery across OT and medical networks, establishes behavioral baselines, validates compliance continuously in real time, and models attack paths, so security teams understand adversary movement. Automated remediation workflows execute across brownfield environments without custom engineering.

Identity & Access Security: Non-human identities, service accounts, cloud identities, and AI agents are everywhere and almost entirely ungoverned. ServiceNow enables security teams to see, control, and govern every identity across the enterprise under consistent least-privilege principles.

• AI Agent Access Security unifies access control for AI agents across any platform or model provider, closing the threat vector of ungoverned agents with escalated permissions.
• Non-Human Identity Remediation moves beyond risk scoring into active action: automated key rotation, deprovisioning, and permission revocation at scale across IT, OT, IoT, and medical networks; enables AI agents and service accounts to operate under identical identity governance as human users.

Agentic Incident Response: Incident response teams can lose hours stitching together threat intelligence, asset ownership, and identity data when they should be stopping threats. ServiceNow automates triage and investigation, freeing analysts to focus on sophisticated threats.

• Agentic Incident Response enables ServiceNow’s Tier 2 SOC AI Specialist to autonomously build and execute multi-phase response plans for complex incidents, performing actions like enrichment, correlation, containment and blocking while escalating only high-risk decisions to human analysts.

Cyber Risk and Compliance: Compliance remains a pre-audit scramble. Evidence collection is manual, controls are monitored quarterly, and organizations are stuck playing catch-up. ServiceNow transforms compliance from a seasonal event into a continuous operational signal.

• Agentic AI for Continuous Control Monitoring transforms control evidence into a continuous operational signal. Automated agents evaluate segregation of duties, access rights, and configuration state across ServiceNow and external systems in real time, surfacing violations the moment they occur. Compliance-ready reports exist on demand across regulatory frameworks including SOC 2, ISO 27001, PCI-DSS, and HIPAA.
• Cryptographic Asset Compliance enables rapid migration from legacy cryptographic algorithms to quantum-resistant standards before the quantum threat window closes. ServiceNow delivers comprehensive discovery, AI-powered risk profiling, and guided migration workflows across on-premises and cloud environments, with full integration to ServiceNow Integrated Risk Management and Governance, Risk, and Compliance (IRM/GRC) products for regulatory compliance evidence at enterprise scale.

Availability

Agentic Exposure Management, Autonomous Remediation Agents, Application Security, Dynamic Application Security Testing (DAST), External Attack Surface Management (EASM), Agentic AI for Cyber Physical Security, AI Agent Access Security, Non-Human Identity Remediation are available now. Tier 2 SOC AI Specialist, Vulnerability Resolution AI Specialist, Agentic AI for Continuous Control Monitoring, and Cryptography Asset Compliance are expected to be available in December 2026.

New data in ServiceNow’s AI Maturity Index shows that Canadian companies are going big on AI, but the next test is turning that spend into real results. Canadian organizations expect AI to account for 22% of IT budgets by 2027 – doubling year over year – yet companies are lagging in execution.

The question now is: how can companies move from AI investment to measurable business impact?

You can read the report here: https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/resource-center/white-paper/wp-enterprise-ai-maturity-index-2026.pdf

ServiceNow is warning customers through a support bulletin about a security incident after hackers exploited an unauthenticated access flaw through a vulnerable API endpoint, allowing them to query data from customer instances.

Bleeping Compiter has the details here:  https://www.bleepingcomputer.com/news/security/servicenow-discloses-security-incident-exposing-customer-data/

Dan Moore, Sr. Director CIAM Strategy at cybersecurity company FusionAuth, provided the following comments:

“Everyone’s calling this an unauthenticated API vulnerability. The attacker bypassed the authentication because there wasn’t any. The endpoint, which lets you create related lists to show up on ServiceNow forms, apparently had its authentication check default to off. It’s unclear how long this has been exposed.

A one-line smoke test “hit the endpoint with no credentials, expect a rejection” catches this. Nobody wrote the test, because the platform treated ‘no auth’ as valid configuration for a sensitive endpoint. When authentication is something you toggle per endpoint instead of a default the platform enforces, an exposed endpoint isn’t a bug the system rejects. It’s a setting someone forgot to change.

If you manage an application with an API, does an endpoint with no auth fail your build, or does it just ship?”

It should not ship. But that is now how the universe sees things. Maybe the universe should change.

ServiceNow and Amazon Web Services (AWS) today announced a platform expansion as companies rapidly deploy and scale agentic AI across the enterprise, which follows a significant milestone of ServiceNow’s AWS Marketplace transactions surpassing $1 billion. The expansion introduces a governance architecture for mutual customers built on ServiceNow AI Control Tower and Amazon Bedrock AgentCore; new AI agent integrations for enterprise security, IT operations, and telecommunications that detect, act, and resolve issues; and a native developer integration that lets teams build and deploy ServiceNow applications directly from Kiro, the AWS agentic integrated development environment (IDE), so that developers can move from idea to impact faster.

ServiceNow’s $1 billion milestone reflects something larger than a commercial threshold. Enterprises are consolidating their AI infrastructure around platforms they trust, and increasingly, that means combining cloud and foundation model services with orchestration, governance, and workflow execution. ServiceNow’s platform expansion with AWS is a direct response to that demand: customers who have already committed to both platforms now have a single, connected architecture to deploy and scale AI. The AI workloads they’ve already built and deployed on AWS can now be governed, audited, and wired into the ServiceNow workflows that run their business, without rebuilding anything from scratch.

AI Control Tower and Amazon Bedrock AgentCore: where enterprise AI gets built and governed

Enterprises scaling agentic AI face a common problem: agents built on different models, governed by different teams, with no unified view of what they are doing or whether they are working. ServiceNow AI Control Tower and Amazon Bedrock AgentCore address this together. Amazon Bedrock AgentCore provides the flexible foundation to build agents on the models and infrastructure customers trust, while ServiceNow AI Control Tower delivers the unified control plane to help govern how those agents operate across the business. Leading enterprises are building toward this architecture now.

ServiceNow AI specialists and AWS AI agents tackle critical enterprise workflows

Across security, IT operations, and telecommunications, manual triage and system handoffs compound risk and delay outcomes. ServiceNow AI specialists working alongside AWS AI agents handle these workflows end-to-end, with humans in the loop to guide important decisions.

• Security use case: The moment a configuration change is detected in the Configuration Management Database (CMDB), ServiceNow’s Vulnerability Resolution AI Specialist calls the AWS Security Agent via the Model Context Protocol (MCP) to run an on-demand penetration test against the affected application. ServiceNow then layers on identity blast radius from Veza and device exposure from Armis, producing a complete risk picture. It then determines the fix and presents it for a single human approval. Remediation executes on two parallel tracks: patch deployed, privileges reduced. A final call to the AWS Security Agent will confirm that the fix is clean.
• IT operations use case: An anomaly detected by Amazon CloudWatch is routed to ServiceNow, where ServiceNow’s AIOps AI Specialist and SRE AI Specialist collaborate with the AWS DevOps Agent to correlate events, enrich signals with business context, and validate and execute remediation with human approval. Post-remediation, alerts are confirmed cleared, often proactively without a formal incident ever being raised.
• Telecommunications use case: A ServiceNow and AWS AI-orchestrated telecommunications customer care solution leverages the combined strengths of Amazon Connect for interactions, AWS for infrastructure intelligence, and ServiceNow Telecommunications Service Management for orchestration. When a customer contacts support, a transcript streams into the ServiceNow Telco Customer 360-powered agent workspace in real time via Amazon Connect. ServiceNow’s AI specialist queries RADCOM, a cloud-native network intelligence provider running on AWS, for a scored assessment of voice, video, and streaming quality via Agent-to-Agent (A2A), and simultaneously queries ARIA for billing history and lifetime value. Based on findings and knowledge base rules, the AI specialist recommends a resolution, routes important decisions for human approval, triggers field dispatch if required, and closes the case with a full audit trail.

Build and deploy ServiceNow AI Agents directly from Kiro

ServiceNow is bringing the ServiceNow SDK with Build Agent skills natively into Kiro, giving developers the ability to build and deploy ServiceNow applications, including AI agents, directly from the AWS IDE. With a single-click install from the Kiro Power Marketplace, developers can scaffold applications, configure workflows, and create AI agents through prompt engineering without ever leaving their IDE. Because everything runs natively on the ServiceNow AI Platform, developers get enterprise governance and security without any additional configuration.

Availability

• ServiceNow AI Control Tower with Amazon Bedrock AgentCore is available now in AWS Marketplace.
• The ServiceNow Vulnerability Resolution AI Specialist, AIOps AI Specialist, and SRE AI Specialist integrations with AWS AI agents is expected to be available later this year, with launch details to follow.
• The AI specialist workflow for telecommunications is available now. ServiceNow Telecommunications Service Management is a generally available product and now includes ServiceNow Telco Customer 360 as part of the Australia Platform release.
• The ServiceNow SDK for Kiro is available now through the Kiro Power Marketplace.
• Learn more about how ServiceNow is expanding its Autonomous Workforce of AI Specialists to major business functions at Knowledge 2026 here, and how it’s introducing new AI Control Tower capabilities to further discover, observe, govern, secure, and measure AI deployed across the enterprise here.

Today, at ServiceNow’s annual customer and partner event, Knowledge 2026, ServiceNow introduced AI Learning Guide and SimStudio within ServiceNow University, an AI learning platform transforming workforce development for the AI era. The new capabilities give customers, partners, and individual learners, including ServiceNow’s own global workforce, a faster, more personalized path to building real-world skills on the ServiceNow AI Platform.

The World Economic Forum projects a net gain of 78 million jobs by 2030, driven by technology, demographics, and economic shifts, with AI and big data topping the list of fastest-growing skills. This underscores an urgent need for reskilling.

The industry’s answer until now has been static instruction sheets, pre-recorded videos, and time-based certifications that measure course completion instead of competency. People need a safe space to experiment with AI in the flow of work, build confidence through practice, and chart a clear path to the careers emerging inside agentic businesses built on the ServiceNow AI Platform. ServiceNow University is that space: an open playground for learning where everyone is welcome, built on the science of play to counteract the fear of failure and make skill-building sustainable.

AI Learning Guide and SimStudio drive AI career readiness with a coach + practice model

Most enterprise learning platforms deliver a catalog of content. Learners scroll through courses across multiple learning tools, with no guidance on what matters for their role.

AI Learning Guide changes that. It is a conversational AI coaching companion embedded directly into ServiceNow University that guides learners through personalized learning paths, surfaces relevant courses and certifications, and provides real-time coaching and feedback. AI Learning Guide delivers contextual recommendations and next steps, and acts as the coaching layer that transitions learners into simulation-based practice.

SimStudio is a hands-on simulation environment that lets learners prove competencies by practicing and performing ServiceNow tasks. Unlike videos or quizzes, SimStudio captures how a learner works, not just whether they finished a course, enabling richer competency insight. It flags whether they used ServiceNow best practices and offers feedback and alternative methods accordingly.

Together, AI Learning Guide and SimStudio accelerate time-to-competence and give learners confidence that they can do the work, not just pass a test. AI Learning Guide tailors the journey; SimStudio delivers the prove-it moment.

Underpinning both tools is a personalized learning profile that matches recommendations to each learner’s role, usage patterns, skills, and behaviors, surfacing what to learn next without requiring learners to navigate the full catalog. The profile applies “people like you” logic so a system administrator in financial services with heavy ITSM usage receives different guidance than one in manufacturing.

ServiceNow University reaches almost 2 million learners with 80% growth year-over-year

Without certified talent, enterprise AI investments stall, depleting leadership pipelines and slowing the innovation those investments were meant to accelerate. ServiceNow University is helping close that gap at scale.

One year after its launch at Knowledge 2025, ServiceNow University has grown to nearly 2 million learners and 307,000 certified professionals, with momentum across the entire ecosystem: customer learners grew 28%, partner participation increased 17%, and employee participation jumped 24% year over year.

According to an IDC study, sponsored by ServiceNow, organizations that complete ServiceNow training and certifications see a 536% ROI on training investments in the first three years through staff efficiencies, cost savings, improved productivity, and +16% productivity gains through upskilled employees.

Training and certifications also drive measurable partner and customer growth. According to a ServiceNow study, when partner teams have a certified implementation lead, their customers go live one month faster and report higher satisfaction scores. Customers with certified implementors show 7-point higher gross retention and 14-point higher net retention. The pattern is consistent: more certified professionals correlate with higher license usage, greater app deployment, and stronger retention.

Availability

• ServiceNow University is free and available to all employees, customers, partners, and individual learners at learning.servicenow.com.

• AI Learning Guide and SimStudio are available to learners today.

• ServiceNow University is expanding its reach to new markets: New Arabic language support launched in March 2026; localized content in Brazilian Portuguese is underway.

• ServiceNow University’s new capabilities are part of a broader wave of AI platform innovation ServiceNow will unveil at Knowledge 2026, taking place May 5–7 at The Venetian Expo Center in Las Vegas. For more information on Knowledge 2026, visit servicenow.com/events/knowledge

Today, at ServiceNow’s annual customer and partner event announced a major expansion of its Autonomous Workforce, launching new AI specialists for IT, customer relationship management (CRM), employee service teams, and security and risk. Together with the previously announced L1 IT Service Desk AI Specialist, which is now available, these AI specialists complete end-to-end processes alongside humans to autonomously resolve cases, contain threats, manage incidents, and handle high-volume employee requests.

Enterprises today run on a patchwork of systems where talented people spend time answering routine questions, triaging backlogs, updating records, and racing between fire drills. The work that moves the business, such as strategic decisions, relationship building, and risk assessment, gets pushed to the margins as a result. Autonomous Workforce deploys role-scoped AI specialists embedded in proven workflows to deliver outcomes from start to finish, without human intervention.

Because AI specialists run on the same platform, they share the same operational intelligence (Configuration Management Database and Context Engine), data connectivity (Workflow Data Fabric), conversational front door (ServiceNow EmployeeWorks), and governance infrastructure (AI Control Tower). ServiceNow announced in April that all of these capabilities are now included across every product and package; not as add-ons but built-in by default. This allows enterprises to build on years of platform investment and achieve speed, scale, and oversight, without adding complexity or extending time to value. ServiceNow has also expanded the reach of its Autonomous Workforce to more customers in partnership with Amazon Web Services (AWS), Google Cloud, Microsoft, and NVIDIA, enabling AI specialists to deploy and run across the infrastructure enterprises already use.

Autonomous IT: from reactive firefighting to autonomous resilience

IT teams today face a backlog of unresolved incidents, security findings, and operational recommendations that grow faster than any team can act on, consuming bandwidth that should be going toward AI governance, strategic investment, and platform scale. The L1 IT Service Desk AI Specialist is already resolving assigned IT cases 99% faster than human agents within ServiceNow’s own help desk. Building on that foundation, ServiceNow is introducing a wave of new IT AI specialists spanning infrastructure monitoring, site reliability (SRE), asset lifecycle, portfolio planning, and more.

For example, a new specialist for AIOps autonomously detects anomalies, correlates events, and triggers remediation, while a specialist for SRE handles incident triage and postmortem documentation end to end, so IT teams can shift attention from reactive firefighting to strategic infrastructure investment. Other new AI specialists for common IT workflows give full visibility into hardware, software, and cloud assets across their lifecycle, and connect demand to capacity, budget, and resource availability in real time.

Autonomous CRM: AI that acts on customer interactions

Legacy CRM systems track sales activities and service interactions but don’t fulfill customer requests. Whether a customer is requesting a quote, asking to expedite an order, or disputing a charge, the goal should be to give them what they want, not open new opportunities or tickets. The gap between front-office interaction and back-office fulfillment is where customer experience breaks down. According to Ipsos research, sales representatives spend just 10 hours a week talking to customers. At the same time, ServiceNow’s CX Shift research shows that service agents still need to work in three to five systems to resolve a single customer issue, with the rest of their time lost to CRM updates, manual handoffs, and administrative overhead.

ServiceNow Autonomous CRM is built to finish the work, from speed of thought sales to customer service automation. Today, ServiceNow is introducing new AI specialists across the entire customer lifecycle, including sales qualification and quoting, order fulfillment, invoice disputes, service, and renewals. Starting with case management, an AI specialist can triage, solve, and escalate cases across channels, as well as generate custom quotes from meeting transcripts. Each month, ServiceNow Autonomous CRM resolves over 100 million customer cases, orchestrates over 16 million orders, and configures more than seven million quotes. These AI specialists go further, delivering quotes, orders, and issue resolution faster for customers.

Employee services: an AI workforce for every team, across every function

HR, finance, legal, procurement, and workplace services teams face structural challenges at scale, including rising case volumes and service desks dependent on manual triage. Based on ServiceNow estimates, 23 million employees use ServiceNow’s employee portal every month, generating an estimated 40 million-plus cases annually.

This is routine, repeatable work that’s ideal for autonomous resolution.

ServiceNow is introducing new AI specialists across HR, workplace services, legal, finance, procurement, supplier management, and health and safety. Each acts as a digital employee that is equipped with role-specific skills. Across ServiceNow’s customer base, they’ve been shown to resolve 91% of the cases without reassignment. Requests are deflected before they become cases, and when cases are created, they route directly to the right AI specialist.

This allows business operations teams to focus on tasks like workforce planning, supplier strategy decisions, financial planning, contract negotiations, and more.

Security and risk: containing threats in minutes

Security and risk teams are overwhelmed: vulnerabilities accumulate faster than teams can triage them, supercharged by AI-powered attack surface expansion; phishing incidents demand immediate investigation across disconnected tools; and manual response processes stretch resolution from minutes to hours. Legacy point solutions simply weren’t built to keep pace with the AI platform shift.

ServiceNow’s new Autonomous Security & Risk solution introduces AI specialists purpose-built to help eliminate growing backlogs across the full threat landscape, autonomously triaging and remediating vulnerabilities (including hardware-level), investigating and containing SOC incidents with humans-in-the-loop, and screening third-party vendor risk with instant summaries so teams focus only on what needs scrutiny. Together, they compress tasks that typically take days or hours into minutes, bringing identity visibility and governance, cyber asset intelligence, enterprise decision context, and autonomous security operations together on the ServiceNow AI Platform.

Availability

L1 IT Service Desk AI Specialist, CRM AI specialists, and AI specialists for employee service teams are available now. IT AI specialists are expected to be available in June 2026. The security and risk AI specialists are expected to be available for preview in June 2026 and generally available in September 2026.