ServiceNow has patched three maximum-severity vulnerabilities, including two leading to remote code execution.