Critical ServiceNow AI Platform Vulnerabilities: Unauthenticated SQL Injection and Authorization Bypasses (CVE-2026-13016, CVE-2026-86857-86860)

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2653 across Splunk SPL, Microsoft KQL and Sigma, covering 2 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Suspicious SQL Against ServiceNow Instance Database — Schema Discovery, Identity Reads, Destructive DML (CVE-2026-13016 DB Side)

Database-layer detection for the arbitrary-SQL consequence of CVE-2026-13016: MySQL/MariaDB audit or general-query-log statements that enumerate schema (information_schema, mysql.user), read identity tables (sys_user), chain stacked or UNION queries, use time-based blind primitives (sleep/benchmark), or issue destructive DML (drop/truncate/alter/delete from). Fires when the injected SQL runs against the instance database after a successful web-layer exploit.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1082, T1087, T1565.001, T1485, T1059
• Data sources: mysql_audit_log, mysqld_general_log, mariadb_audit, syslog_db
• Severity: critical
• Confidence: high

Splunk SPL

index=db (sourcetype=mysql:audit OR sourcetype=mysqld OR sourcetype=mariadb)
| eval q=lower(query)
| where match(q,'information_schema|mysql.user|sys_user')
    OR match(q,'union[ ]+select')
    OR match(q,'drop[ ]+table|truncate[ ]+table|alter[ ]+table|delete[ ]+from')
    OR match(q,'sleep[ (]|benchmark[ (]|load_file|into[ ]+outfile')
| stats count min(_time) as firstSeen max(_time) as lastSeen values(query) as queries by user host db src_ip
| where count>=3
| convert ctime(firstSeen) ctime(lastSeen)

Microsoft KQL

let lookback = 24h;
Syslog
| where TimeGenerated > ago(lookback)
| where ProcessName contains 'mysql' or HostName contains 'servicenow'
| extend q = tolower(Message)
| where q matches regex @'(information_schema|mysql.user|sys_user|union[ ]+select|drop[ ]+table|truncate[ ]+table|alter[ ]+table|delete[ ]+from|sleep[ (]|benchmark[ (]|load_file|into[ ]+outfile)'
| summarize Cnt = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by HostName, ProcessName
| where Cnt >= 3
| order by LastSeen desc

Sigma

title: Suspicious SQL Against ServiceNow Instance Database (CVE-2026-13016)
id: d4a3b3f1-2653-4e33-af44-2e4f6b8c0d22
status: experimental
description: Detects SQL statements in the ServiceNow instance database audit or general query log matching arbitrary-SQL exploitation of CVE-2026-13016: schema enumeration, identity-table reads, stacked/UNION queries, time-based blind primitives, and destructive DML.
references:
    - 'https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623'
    - 'https://nvd.nist.gov/vuln/detail/CVE-2026-13016'
    - 'https://attack.mitre.org/techniques/T1082/'
    - 'https://attack.mitre.org/techniques/T1565/001/'
author: Threadlinqs Team
date: 2026/09/25
tags:
    - attack.discovery
    - attack.t1082
    - attack.discovery
    - attack.t1087
    - attack.impact
    - attack.t1565.001
    - attack.impact
    - attack.t1485
    - cve.2026.13016
logsource:
    product: mysql
    category: database
detection:
    selection_schema:
        query|contains:
            - 'information_schema'
            - 'mysql.user'
    selection_identity:
        query|contains|all:
            - 'select'
            - 'sys_user'
    selection_destructive:
        query|contains:
            - 'drop table'
            - 'truncate table'
            - 'alter table'
            - 'delete from'
    selection_blind:
        query|contains:
            - 'sleep('
            - 'benchmark('
            - 'load_file'
            - 'into outfile'
    condition: selection_schema or selection_identity or selection_destructive or selection_blind
falsepositives:
    - DBA tooling (mysqldump, SchemaCrawler) reading information_schema during maintenance
    - Scheduled ETL jobs truncating staging tables
    - Legitimate upgrades issuing ALTER TABLE during release windows
level: high

Known false positives:

• Authorized DBA schema tooling reading information_schema during maintenance windows
• Scheduled ETL truncates of staging tables
• Release automation issuing ALTER TABLE during approved deployment windows

Tuning notes: Enable statement-level audit logging on the instance database so full query text is captured. Swallow routine DDL from the app-tier account and DBAs by user/host allowlist, but treat destructive DML from any account outside the app tier as critical. Correlate timestamps with the web-layer SQLi rules: compressed time between a SQLi probe and matching DB queries confirms live CVE-2026-13016 exploitation.

• 🔒 ServiceNow API SQL Injection — WAF/CEF Request-URL Signatures (CVE-2026-13016) · unlock with TL Creds
• 🔒 ServiceNow GraphQL Introspection and Unauthorized Mutations — AI Platform (CVE-2026-86858/86859) · unlock with TL Creds
• 🔒 ServiceNow Database Audit — Schema Enumeration / Destructive SQL — Syslog (CVE-2026-13016) · unlock with TL Creds
• 🔒 ServiceNow API SQL Injection Probing — Sigma (CVE-2026-13016) · unlock with TL Creds
• 🔒 ServiceNow GraphQL Introspection / Unauthorized Mutation — Sigma (CVE-2026-86858/86859) · unlock with TL Creds
• 🔒 Suspicious SQL Against ServiceNow Instance Database — Sigma (CVE-2026-13016) · unlock with TL Creds
• 🔒 ServiceNow AI Platform SQL Injection — URL-Decoded Payloads in Now Platform API Requests (CVE-2026-13016) · unlock with TL Creds
• 🔒 Unauthorized or Sweeping ServiceNow Table API Reads — AuthZ Bypass / Record Disclosure (CVE-2026-86857/86859/86860) · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 2 indicators of compromise for TL-2026-2653.

Technical analysis

ServiceNow's September 2026 CVE Advisory Notification (KB3159623) discloses five vulnerabilities in the Now Platform AI Platform: CVE-2026-13016 (critical, CVSS 4.0 9.3, CWE-89 unauthenticated SQL injection allowing arbitrary SQL against the instance database) and CVE-2026-86860 (critical, CVSS 4.0 9.3, CWE-862 missing authorization enabling unauthenticated instance-data extraction with privilege-escalation potential), plus three high-severity access-control flaws: CVE-2026-86857 (CVSS 4.0 8.4, authorization bypass for authenticated users), CVE-2026-86858 (CVSS 4.0 8.7, CWE-284 improper access control via GraphQL allowing unauthenticated create/modify/delete of instance data) and CVE-2026-86859 (CVSS 4.0 8.7, CWE-284 unauthenticated authorization bypass / arbitrary record disclosure). ServiceNow has no evidence of in-the-wild exploitation; hosted instances were remediated (August patching program), while partners and self-hosted customers must upgrade to the fixed Yokohama/Zurich/Australia hot-fix releases. None of the five CVEs is in CISA KEV as of publication.

On 25 September 2026 ServiceNow published its September 2026 CVE Advisory Notification (KB3159623) covering five vulnerabilities in the Now Platform AI Platform, surfaced through internal testing, customer assessments, responsible disclosures and the vendor's bug bounty program. The cluster comprises two unauthenticated criticals and three high-severity authorization/access-control issues that affect both hosted and self-hosted instances on every release family below the listed hot-fix levels. NVD records the affected versions via a 'less-than' comparator against seven fixed builds, so any release older than the patched levels - including earlier families such as Washington DC, Vancouver and Utah - is affected; hosted instances were already patched as part of the August 2026 patching program.

CVE-2026-13016 is the most severe flaw: a critical (CVSS 4.0 9.3, AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, CWE-89) SQL injection in the AI Platform. An unauthenticated attacker can, in certain circumstances, execute arbitrary SQL statements against the instance's underlying database, gaining the ability to read, modify or manipulate any instance data - IT service operations, security-incident records, employee requests, asset records, customer information and internal business processes. Arbitrary SQL against the shared instance database inherently enables querying database metadata (system/schema/table discovery) and stored account/user records, reaching data far beyond the AI Platform feature that exposed the flaw.

CVE-2026-86860 is a critical (CVSS 4.0 9.3, VC:H, CWE-862) missing-authorization flaw: an unauthenticated user can extract instance data beyond intended access controls, and the vendor notes exploitation may result in privilege escalation. The three high-severity issues round out the cluster. CVE-2026-86857 (CVSS 4.0 8.4, PR:L) is an authorization bypass under which an authenticated low-privileged user can access AI Platform data they are not entitled to view, potentially enabling further unintended access. CVE-2026-86858 (CVSS 4.0 8.7, VI:H) is an improper-access-control issue (CWE-284) exposed via the GraphQL interface - characterized in CNA records as unauthenticated privilege escalation via GraphQL - letting an unauthenticated attacker create, modify or delete instance data outside intended permissions. CVE-2026-86859 (CVSS 4.0 8.7, VC:H, CWE-284) is an authorization bypass allowing an unauthenticated attacker to disclose arbitrary/restricted records the system normally protects, leading to disclosure of confidential information. CVE identifiers were reserved on 8 September 2026 and all five published 24 September 2026.

Exploitation posture: ServiceNow states it is 'not currently aware of malicious exploitation against ServiceNow instances.' CISA-coordinator SSVC v2.0.3 assessments rate exploitation 'none' for all five but flag automation risk: automatable 'yes' for CVE-2026-86858, CVE-2026-86859 and CVE-2026-86860, and technicalImpact 'total' for CVE-2026-13016 - an unauthenticated, network-reachable SQLi/GraphQL access-control cluster that is a prime mass-exploitation candidate on internet-exposed instances even before public PoCs or weaponized tooling circulate. None of the five CVEs appears in CISA KEV as of 2026-09-25.

Remediation: hosted customers in the patching program already received fixes (deployed to hosted instances in August 2026); partners and self-hosted customers must apply the fixed releases - Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 Hot Fix 3b, Patch 10 Hot Fix 4a W32 or Patch 11 Hot Fix 3; Australia Patch 2 Hot Fix 4b W32, Patch 4 Hot Fix 3 or Patch 5. No vendor workaround is provided. Interim mitigations include restricting network exposure of AI Platform endpoints, enforcing strict authentication on GraphQL endpoints, enabling WAF SQL-injection rules, and - per vendor guidance - confirming deployed versions, reviewing administrative access, and monitoring for unusual database queries, unexpected data changes, and unauthorized access attempts after patching.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1087 Account Discovery

Impact

T1485 Data Destruction; T1565.001 Stored Data Manipulation

Remediation

Patches

• Yokohama Patch 13 Hot Fix 5a
• Zurich Patch 10 Hot Fix 3b
• Zurich Patch 10 Hot Fix 4a W32
• Zurich Patch 11 Hot Fix 3
• Australia Patch 2 Hot Fix 4b W32
• Australia Patch 4 Hot Fix 3
• Australia Patch 5

Immediate actions

• Upgrade self-hosted instances to a fixed release immediately: Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 Hot Fix 3b, Patch 10 Hot Fix 4a W32 or Patch 11 Hot Fix 3; Australia Patch 2 Hot Fix 4b W32, Patch 4 Hot Fix 3 or Patch 5
• Confirm your deployed release family/patch level against KB3159623 and verify the fix was applied (NVD 'less-than' comparator means any older build, including Washington DC/Vancouver/Utah families, is affected)
• Restrict network access to AI Platform endpoints and enforce strict authentication on GraphQL endpoints as interim mitigations (no vendor workaround provided)
• Enable WAF SQL-injection rules in front of internet-exposed instances while patching is pending
• Review HTTP/logs for unauthenticated requests containing SQL-like keywords, anomalous GraphQL introspection or mutation traffic, and unauthorized access attempts

Workarounds

• Restrict network access to AI Platform endpoints until patched
• Enforce strict authentication on GraphQL endpoints (CVE-2026-86858 / CVE-2026-86859)
• Block unauthenticated access to AI Platform query interfaces; enable WAF SQLi rules as interim control

Longer-term hardening

• Maintain ServiceNow instances on supported release families with a formal, tested patch cadence; subscribe to ServiceNow security advisories
• Review and tighten AI Platform access-control policies to least privilege; audit role assignments and administrative access
• Monitor for unusual database queries, unexpected data changes, and unauthorized access attempts after patching, per vendor guidance
• Treat AI Platform endpoints (including GraphQL) as sensitive surface and keep them behind network segmentation/SSO
• Re-evaluate the AI Platform data plane: catalog which instance tables are reachable through AI features and apply ACL hardening

Affected and fixed versions

• ServiceNow — Now Platform AI Platform
  Vulnerable versions: All releases below: Yokohama Patch 13 Hot Fix 5a; All releases below: Zurich Patch 10 Hot Fix 3b / Hot Fix 4a W32 / Patch 11 Hot Fix 3; All releases below: Australia Patch 2 Hot Fix 4b W32 / Patch 4 Hot Fix 3 / Patch 5; Earlier release families (e.g., Washington DC, Vancouver, Utah) - NVD affects-versus 'less-than' the listed hot-fix builds
  Fixed in: Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 Hot Fix 3b; Zurich Patch 10 Hot Fix 4a W32; Zurich Patch 11 Hot Fix 3; Australia Patch 2 Hot Fix 4b W32; Australia Patch 4 Hot Fix 3; Australia Patch 5

Timeline

• 2026-08-31 ServiceNow deploys security updates to hosted instances as part of the August 2026 patching program and provides fixes to partners, ahead of public disclosure
• 2026-09-08 CVE identifiers reserved: OpenCVE/MITRE record for CVE-2026-86859 shows reservation at 2026-09-08T15:45:29.697Z; the AI Platform access-control cluster (CVE-2026-86857/86858/86859/86860) was reserved around the same date
• 2026-09-24 CISA-coordinator SSVC v2.0.3 assessments: exploitation 'none' for all five; automatable 'yes' for CVE-2026-86858/86859/86860 and 'no' for CVE-2026-13016/86857; technicalImpact 'total' for CVE-2026-13016, 'partial' for the high-severity set
• 2026-09-24 All five CVEs publish: CVE-2026-13016 (SQLi, CVSS 4.0 9.3, CWE-89), CVE-2026-86860 (missing authorization, 9.3, CWE-862), CVE-2026-86857 (authz bypass, 8.4, PR:L), CVE-2026-86858 (GraphQL improper access control / unauth privilege escalation, 8.7, CWE-284), CVE-2026-86859 (authz bypass / arbitrary record disclosure, 8.7, CWE-284); NVD timestamps 2026-09-24T18:52-19:17Z, assigner ServiceNow PSIRT
• 2026-09-25 ServiceNow states it has not identified evidence of in-the-wild exploitation; none of the five CVEs appears in CISA KEV as of publication; NVD records remain in 'Awaiting Analysis' status
• 2026-09-25 Cybersecurity News publishes day-of coverage ('Critical ServiceNow Vulnerabilities Expose Enterprise Data to Unauthenticated Attacks') describing impacts, affected release families, and post-patch monitoring guidance for internet-exposed instances
• 2026-09-25 ServiceNow publishes the September 2026 CVE Advisory Notification (KB3159623) covering the five AI Platform flaws with fixed release families: Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 HF 3b / HF 4a W32 / Patch 11 HF 3; Australia Patch 2 HF 4b W32 / Patch 4 HF 3 / Patch 5

Sources cited

• ServiceNow [Security Advisory] September 2026 CVE Advisory Notification (KB3159623) support.servicenow.com · Advisory · 2026-09-25
• CISA Known Exploited Vulnerabilities Catalog (feed - none of the five CVEs listed as of 2026-09-25) CISA · Government advisory · 2026-09-25
• NVD - CVE-2026-13016 (SQL injection, CVSS 4.0 9.3, CWE-89) NVD (NIST) · Research · 2026-09-24
• NVD - CVE-2026-86860 (Missing authorization, CVSS 4.0 9.3, CWE-862) NVD (NIST) · Research · 2026-09-24
• NVD - CVE-2026-86857 (Authorization bypass, CVSS 4.0 8.4) NVD (NIST) · Research · 2026-09-24
• NVD - CVE-2026-86858 (Improper access control via GraphQL, CVSS 4.0 8.7, CWE-284) NVD (NIST) · Research · 2026-09-24
• NVD - CVE-2026-86859 (Authorization bypass / arbitrary record disclosure, CVSS 4.0 8.7, CWE-284) NVD (NIST) · Research · 2026-09-24
• OpenCVE - CVE-2026-13016 (Unauthenticated SQL Injection in ServiceNow AI Platform) app.opencve.io · Research · 2026-09-24
• OpenCVE - CVE-2026-86860 (Missing Authorization in ServiceNow AI Platform) app.opencve.io · Research · 2026-09-24
• OpenCVE - CVE-2026-86857 (Authorization Bypass in ServiceNow AI Platform) app.opencve.io · Research · 2026-09-24
• OpenCVE - CVE-2026-86858 (Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform) app.opencve.io · Research · 2026-09-24
• OpenCVE - CVE-2026-86859 (Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform) app.opencve.io · Research · 2026-09-24
• Cybersecurity News - Critical ServiceNow Vulnerabilities Expose Enterprise Data to Unauthenticated Attacks cybersecuritynews.com · News · 2026-09-25

More in vulnerability

• PostgreSQL CVE-2026-6460: 22-Year-Old Composite Type Confusion Enables Authenticated RCE; 52 CVEs Fixed in 18.7/17.12/16.16/15.20/14.25
• Citrix NetScaler ADC and Gateway: 28 Vulnerabilities Patched (CTX697305), Including Critical CVE-2026-120868 in Default Configurations
• Forescout Vedere Labs: AI-assisted harness finds 66 new vulnerabilities across 10 legacy TCP/IP stacks used in OT/IoT (incl. Nucleus NET CVE-2026-89208, CVE-2026-102073..102076; Ethernut CVE-2026-120596)
• GitHub Security Lab Taskflow Agent identifies 24 Android app vulnerabilities (OsmAnd exported MapActivity location tracking, Wikipedia deeplink account takeover; CVE-2026-65993 to CVE-2026-65997)
• SignDrop – Windows CLFS/Defender Local Privilege Escalation Zero-Day with Public PoC (Nightmare Eclipse)

Previous and next in vulnerability

• Cross-tenant data exposure in Cloudflare Containers/Sandboxes/Browser Run via Linux dm-thin skip_block_zeroing residual block reuse Previous report
• Multiple PHP Vulnerabilities Enable Denial of Service, TLS Verification Bypass, and Credential Leakage (CVE-2026-91765, CVE-2026-91768, CVE-2026-6103 and 8 Others) — GovCERT.HK A26-09-40 Next report