Critical ServiceNow Vulnerabilities Let Attackers Bypass Authorization – Update Now!
ServiceNow patched five AI Platform flaws, including critical unauthenticated SQL injection, with no known exploitation.
ServiceNow advisory KB3159623 covers five AI Platform vulnerabilities found through internal testing, customer assessments, and its bug bounty. Critical CVE-2026-13016 is SQL injection that can let an unauthenticated attacker run arbitrary SQL and read or modify instance data. Critical CVE-2026-86860 is missing authorization that can expose data and support privilege escalation. High-severity CVE-2026-86857, CVE-2026-86858, and CVE-2026-86859 are authorization and access-control flaws. ServiceNow says it has no evidence of exploitation; self-hosted customers should apply the listed Yokohama, Zurich, and Australia hotfixes.
- CVE-2026-13016 is critical unauthenticated SQL injection against the instance database.
- CVE-2026-86860 is a critical missing-authorization flaw that can expose instance data.
- Three high-severity flaws allow authenticated or unauthenticated access-control bypass.
- ServiceNow reports no exploitation evidence; August program customers already have fixes.
- Self-hosted fixes include Yokohama, Zurich, and Australia patch hotfixes.
- Vendors
- ServiceNow
- Products
- ServiceNow AI Platform
- Organizations
- ServiceNow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-13016+4 related CVEs | Unauthenticated SQL Injection in ServiceNow AI Platform (CVSS 9.3) | 9.3 group max | — |
From the original article
2 min read at cybersecuritynews.com
ServiceNow released security updates for five AI Platform flaws, including two critical vulnerabilities that could let unauthenticated attackers access, modify, or extract sensitive instance data, urging self-hosted users to verify versions and patch promptly.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.