ServiceNow Security Flaws Allow Attackers to Execute SQL and Modify Instance Data
ServiceNow patched five AI Platform flaws, including critical unauthenticated SQL injection and missing authorization.
ServiceNow disclosed five vulnerabilities in its AI Platform in advisory KB3159623, dated September 24, 2026. Critical CVE-2026-13016 is an unauthenticated SQL injection that can run arbitrary SQL and access or alter instance data. Critical CVE-2026-86860 is a missing-authorization issue that can extract data and escalate privileges. High-severity CVE-2026-86857, CVE-2026-86858, and CVE-2026-86859 involve authorization bypass or improper access control. ServiceNow says it has found no evidence of exploitation and urges self-hosted customers to install the September 2026 fixed releases.
- Five flaws affect the ServiceNow AI Platform; two are critical and unauthenticated.
- CVE-2026-13016 allows arbitrary SQL execution and data access or modification.
- CVE-2026-86860 is a missing-authorization flaw enabling data extraction and privilege escalation.
- Three high-severity bugs allow unauthorized access or create, modify, and delete actions.
- ServiceNow reports no malicious exploitation; self-hosted customers should apply September 2026 patches.
- Vendors
- ServiceNow
- Products
- ServiceNow AI Platform
- Organizations
- ServiceNow
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-13016+4 related CVEs | Unauthenticated SQL Injection in ServiceNow AI Platform (CVSS 9.3) | 9.3 group max | — |
From the original article
2 min read at gbhackers.com
ServiceNow has disclosed five vulnerabilities affecting its AI Platform, including two critical flaws that could allow unauthenticated attackers to execute arbitrary SQL commands, extract sensitive instance data, modify records, and escalate privileges.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.