Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses (CVE-2026-13016, CVE-2026-86857-86860)
Critical ServiceNow AI Platform Vulnerabilities (TL-2026-2653) is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-09-25. It has no confirmed attribution, affects ServiceNow Now Platform AI Platform, references 5 CVEs (CVE-2026-13016, CVE-2026-86857, CVE-2026-86858), maps to 9 MITRE ATT&CK techniques (T1005, T1059, T1078), and is covered by 9 detection rules and 2 indicators of compromise.
Key facts for TL-2026-2653
- Threat ID
- TL-2026-2653
- Severity
- CRITICAL
- CVSS
- 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-25
- Last reviewed
- 2026-09-25
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, financial services, health, technology, retail, education, telecoms, it services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 2
ServiceNow's September 2026 CVE Advisory Notification (KB3159623) discloses five vulnerabilities in the Now Platform AI Platform: CVE-2026-13016 (critical, CVSS 4.0 9.3, CWE-89 unauthenticated SQL injection allowing arbitrary SQL against the instance database) and CVE-2026-86860 (critical, CVSS 4.0 9.3, CWE-862 missing authorization enabling unauthenticated instance-data extraction with privilege-escalation potential), plus three high-severity access-control flaws: CVE-2026-86857 (CVSS 4.0 8.4, authorization bypass for authenticated users), CVE-2026-86858 (CVSS 4.0 8.7, CWE-284 improper access control via GraphQL allowing unauthenticated create/modify/delete of instance data) and CVE-2026-86859 (CVSS 4.0 8.7, CWE-284 unauthenticated authorization bypass / arbitrary record disclosure). ServiceNow has no evidence of in-the-wild exploitation; hosted instances were remediated (August patching program), while partners and self-hosted customers must upgrade to the fixed Yokohama/Zurich/Australia hot-fix releases. None of the five CVEs is in CISA KEV as of publication.
How Critical ServiceNow AI Platform Vulnerabilities works
On 25 September 2026 ServiceNow published its September 2026 CVE Advisory Notification (KB3159623) covering five vulnerabilities in the Now Platform AI Platform, surfaced through internal testing, customer assessments, responsible disclosures and the vendor's bug bounty program. The cluster comprises two unauthenticated criticals and three high-severity authorization/access-control issues that affect both hosted and self-hosted instances on every release family below the listed hot-fix levels. NVD records the affected versions via a 'less-than' comparator against seven fixed builds, so any release older than the patched levels - including earlier families such as Washington DC, Vancouver and Utah - is affected; hosted instances were already patched as part of the August 2026 patching program.
CVE-2026-13016 is the most severe flaw: a critical (CVSS 4.0 9.3, AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, CWE-89) SQL injection in the AI Platform. An unauthenticated attacker can, in certain circumstances, execute arbitrary SQL statements against the instance's underlying database, gaining the ability to read, modify or manipulate any instance data - IT service operations, security-incident records, employee requests, asset records, customer information and internal business processes. Arbitrary SQL against the shared instance database inherently enables querying database metadata (system/schema/table discovery) and stored account/user records, reaching data far beyond the AI Platform feature that exposed the flaw.
CVE-2026-86860 is a critical (CVSS 4.0 9.3, VC:H, CWE-862) missing-authorization flaw: an unauthenticated user can extract instance data beyond intended access controls, and the vendor notes exploitation may result in privilege escalation. The three high-severity issues round out the cluster. CVE-2026-86857 (CVSS 4.0 8.4, PR:L) is an authorization bypass under which an authenticated low-privileged user can access AI Platform data they are not entitled to view, potentially enabling further unintended access. CVE-2026-86858 (CVSS 4.0 8.7, VI:H) is an improper-access-control issue (CWE-284) exposed via the GraphQL interface - characterized in CNA records as unauthenticated privilege escalation via GraphQL - letting an unauthenticated attacker create, modify or delete instance data outside intended permissions. CVE-2026-86859 (CVSS 4.0 8.7, VC:H, CWE-284) is an authorization bypass allowing an unauthenticated attacker to disclose arbitrary/restricted records the system normally protects, leading to disclosure of confidential information. CVE identifiers were reserved on 8 September 2026 and all five published 24 September 2026.
Exploitation posture: ServiceNow states it is 'not currently aware of malicious exploitation against ServiceNow instances.' CISA-coordinator SSVC v2.0.3 assessments rate exploitation 'none' for all five but flag automation risk: automatable 'yes' for CVE-2026-86858, CVE-2026-86859 and CVE-2026-86860, and technicalImpact 'total' for CVE-2026-13016 - an unauthenticated, network-reachable SQLi/GraphQL access-control cluster that is a prime mass-exploitation candidate on internet-exposed instances even before public PoCs or weaponized tooling circulate. None of the five CVEs appears in CISA KEV as of 2026-09-25.
Remediation: hosted customers in the patching program already received fixes (deployed to hosted instances in August 2026); partners and self-hosted customers must apply the fixed releases - Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 Hot Fix 3b, Patch 10 Hot Fix 4a W32 or Patch 11 Hot Fix 3; Australia Patch 2 Hot Fix 4b W32, Patch 4 Hot Fix 3 or Patch 5. No vendor workaround is provided. Interim mitigations include restricting network exposure of AI Platform endpoints, enforcing strict authentication on GraphQL endpoints, enabling WAF SQL-injection rules, and - per vendor guidance - confirming deployed versions, reviewing administrative access, and monitoring for unusual database queries, unexpected data changes, and unauthorized access attempts after patching.
MITRE ATT&CK techniques used in TL-2026-2653
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1082 System Information Discovery; T1087 Account Discovery
Impact
Affected products and versions in Critical ServiceNow AI Platform Vulnerabilities
- ServiceNow — Now Platform AI Platform
Vulnerable versions: All releases below: Yokohama Patch 13 Hot Fix 5a; All releases below: Zurich Patch 10 Hot Fix 3b / Hot Fix 4a W32 / Patch 11 Hot Fix 3; All releases below: Australia Patch 2 Hot Fix 4b W32 / Patch 4 Hot Fix 3 / Patch 5; Earlier release families (e.g., Washington DC, Vancouver, Utah) - NVD affects-versus 'less-than' the listed hot-fix builds
Fixed in: Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 Hot Fix 3b; Zurich Patch 10 Hot Fix 4a W32; Zurich Patch 11 Hot Fix 3; Australia Patch 2 Hot Fix 4b W32; Australia Patch 4 Hot Fix 3; Australia Patch 5
Remediation for Critical ServiceNow AI Platform Vulnerabilities
Patches
- Yokohama Patch 13 Hot Fix 5a
- Zurich Patch 10 Hot Fix 3b
- Zurich Patch 10 Hot Fix 4a W32
- Zurich Patch 11 Hot Fix 3
- Australia Patch 2 Hot Fix 4b W32
- Australia Patch 4 Hot Fix 3
- Australia Patch 5
Immediate actions
- Upgrade self-hosted instances to a fixed release immediately: Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 Hot Fix 3b, Patch 10 Hot Fix 4a W32 or Patch 11 Hot Fix 3; Australia Patch 2 Hot Fix 4b W32, Patch 4 Hot Fix 3 or Patch 5
- Confirm your deployed release family/patch level against KB3159623 and verify the fix was applied (NVD 'less-than' comparator means any older build, including Washington DC/Vancouver/Utah families, is affected)
- Restrict network access to AI Platform endpoints and enforce strict authentication on GraphQL endpoints as interim mitigations (no vendor workaround provided)
- Enable WAF SQL-injection rules in front of internet-exposed instances while patching is pending
- Review HTTP/logs for unauthenticated requests containing SQL-like keywords, anomalous GraphQL introspection or mutation traffic, and unauthorized access attempts
Workarounds
- Restrict network access to AI Platform endpoints until patched
- Enforce strict authentication on GraphQL endpoints (CVE-2026-86858 / CVE-2026-86859)
- Block unauthenticated access to AI Platform query interfaces; enable WAF SQLi rules as interim control
Longer-term hardening
- Maintain ServiceNow instances on supported release families with a formal, tested patch cadence; subscribe to ServiceNow security advisories
- Review and tighten AI Platform access-control policies to least privilege; audit role assignments and administrative access
- Monitor for unusual database queries, unexpected data changes, and unauthorized access attempts after patching, per vendor guidance
- Treat AI Platform endpoints (including GraphQL) as sensitive surface and keep them behind network segmentation/SSO
- Re-evaluate the AI Platform data plane: catalog which instance tables are reachable through AI features and apply ACL hardening
CVEs associated with Critical ServiceNow AI Platform Vulnerabilities
CVE-2026-13016, CVE-2026-86857, CVE-2026-86858, CVE-2026-86859, CVE-2026-86860
Weaknesses (CWE) in Critical ServiceNow AI Platform Vulnerabilities
CWE-89, CWE-862, CWE-284
Timeline of Critical ServiceNow AI Platform Vulnerabilities
- ServiceNow deploys security updates to hosted instances as part of the August 2026 patching program and provides fixes to partners, ahead of public disclosure
- CVE identifiers reserved: OpenCVE/MITRE record for CVE-2026-86859 shows reservation at 2026-09-08T15:45:29.697Z; the AI Platform access-control cluster (CVE-2026-86857/86858/86859/86860) was reserved around the same date
- CISA-coordinator SSVC v2.0.3 assessments: exploitation 'none' for all five; automatable 'yes' for CVE-2026-86858/86859/86860 and 'no' for CVE-2026-13016/86857; technicalImpact 'total' for CVE-2026-13016, 'partial' for the high-severity set
- All five CVEs publish: CVE-2026-13016 (SQLi, CVSS 4.0 9.3, CWE-89), CVE-2026-86860 (missing authorization, 9.3, CWE-862), CVE-2026-86857 (authz bypass, 8.4, PR:L), CVE-2026-86858 (GraphQL improper access control / unauth privilege escalation, 8.7, CWE-284), CVE-2026-86859 (authz bypass / arbitrary record disclosure, 8.7, CWE-284); NVD timestamps 2026-09-24T18:52-19:17Z, assigner ServiceNow PSIRT
- ServiceNow states it has not identified evidence of in-the-wild exploitation; none of the five CVEs appears in CISA KEV as of publication; NVD records remain in 'Awaiting Analysis' status
- Cybersecurity News publishes day-of coverage ('Critical ServiceNow Vulnerabilities Expose Enterprise Data to Unauthenticated Attacks') describing impacts, affected release families, and post-patch monitoring guidance for internet-exposed instances
- ServiceNow publishes the September 2026 CVE Advisory Notification (KB3159623) covering the five AI Platform flaws with fixed release families: Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 HF 3b / HF 4a W32 / Patch 11 HF 3; Australia Patch 2 HF 4b W32 / Patch 4 HF 3 / Patch 5
Sources cited for Critical ServiceNow AI Platform Vulnerabilities
- ServiceNow [Security Advisory] September 2026 CVE Advisory Notification (KB3159623)
- Cybersecurity News - Critical ServiceNow Vulnerabilities Expose Enterprise Data to Unauthenticated Attacks
- NVD - CVE-2026-13016 (SQL injection, CVSS 4.0 9.3, CWE-89)
- NVD - CVE-2026-86860 (Missing authorization, CVSS 4.0 9.3, CWE-862)
- NVD - CVE-2026-86857 (Authorization bypass, CVSS 4.0 8.4)
- NVD - CVE-2026-86858 (Improper access control via GraphQL, CVSS 4.0 8.7, CWE-284)
- NVD - CVE-2026-86859 (Authorization bypass / arbitrary record disclosure, CVSS 4.0 8.7, CWE-284)
- OpenCVE - CVE-2026-13016 (Unauthenticated SQL Injection in ServiceNow AI Platform)
- OpenCVE - CVE-2026-86860 (Missing Authorization in ServiceNow AI Platform)
- OpenCVE - CVE-2026-86857 (Authorization Bypass in ServiceNow AI Platform)
- OpenCVE - CVE-2026-86858 (Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform)
- OpenCVE - CVE-2026-86859 (Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform)
- CISA Known Exploited Vulnerabilities Catalog (feed - none of the five CVEs listed as of 2026-09-25)
More in vulnerability
- Cross-tenant data exposure in Cloudflare Containers/Sandboxes/Browser Run via Linux dm-thin skip_block_zeroing residual block reuse
- Cloudflare Containers cross-tenant residual disk data exposure via device-mapper thin-provisioning skip_block_zeroing
- SalesBleed: Salesforce Agentforce vulnerabilities enable zero-click CRM data theft and trusted-agent Slack phishing
- CISA KEV Additions (2026-09-24): WSO2 JWT Authentication Bypass (CVE-2026-5430, CVSS 10.0) and Adobe Commerce/Magento Incorrect Authorization (CVE-2026-71362, CVSS 9.1) Actively Exploited
- cPanel/WHM CalDAV/CardDAV and WP Toolkit Flaws Enable Cross-Account Access and Root Privilege Escalation (CVE-2026-68490, CVE-2026-87899, CVE-2026-87900)
Detection coverage for TL-2026-2653
As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2653 across Splunk SPL, Microsoft KQL and Sigma, covering 2 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.