ServiceNow has issued security updates addressing five vulnerabilities within its AI Platform, including two deemed critical. These flaws could potentially allow attackers to bypass authorization to access, modify, or extract sensitive data. The company strongly advises users managing self-hosted instances to verify their versions and apply patches without delay.
Details of the Vulnerabilities
The vulnerabilities, identified as CVE-2026-86857, CVE-2026-86858, CVE-2026-13016, CVE-2026-86859, and CVE-2026-86860, were discovered through various means, including internal testing, customer assessments, responsible disclosures, and ServiceNow’s bug bounty program. Although there is no evidence of these vulnerabilities being exploited in the wild, their potential impact necessitates swift remediation, especially for systems exposed to the internet or linked to sensitive business operations.
Critical Flaws and Risks
Among the vulnerabilities, CVE-2026-13016 is particularly concerning. This critical flaw involves a SQL injection vulnerability that could enable attackers to execute unauthorized SQL commands on the database of an affected instance. If exploited, this could result in unauthorized access, modification, or manipulation of data, posing significant risks to organizations utilizing ServiceNow for IT services, security management, and more.
Similarly, CVE-2026-86860, another critical issue, pertains to missing authorization controls. This flaw could permit unauthorized data extraction beyond intended access boundaries, potentially leading to privilege escalation and unauthorized access to sensitive information.
Mitigation and Recommendations
ServiceNow’s advisory also includes details on three additional high-severity vulnerabilities related to authorization and access control. CVE-2026-86857 allows unauthorized access to AI Platform data, while CVE-2026-86858 and CVE-2026-86859 involve improper access control issues, enabling data creation, modification, or deletion beyond set permissions.
Customers participating in ServiceNow’s August Patching Program have already received necessary updates. Those with self-hosted systems are urged to upgrade or apply the patches promptly, with patched versions including Yokohama Patch 13 Hot Fix 5a and others. Organizations are advised to confirm their deployed versions, review administrative permissions, and monitor for unusual database activity following patch application.
In conclusion, addressing these vulnerabilities is crucial for maintaining data integrity and security within organizations. ServiceNow’s proactive measures underscore the importance of regular patch management and vigilant monitoring to protect against potential threats.
