ServiceNow has issued important security updates for five vulnerabilities in its AI Platform. Two of them are rated critical and could, under certain conditions, allow unauthenticated attackers to access, modify, or extract data from an instance.
The vulnerabilities, which were listed as CVE-2026-86857, CVE-2026-86858, CVE-2026-13016, CVE-2026-86859 and CVE-2026-86860, mainly concern authorization and access control mechanisms. ServiceNow says the issues were identified through internal security testing, customer reviews, responsible disclosures and its bug bounty program. The company also says it has not seen any evidence of malicious exploitation of the vulnerabilities to date.
Critical SQL injection vulnerability
The most significant of the five issues is CVE-2026-13016, a SQL injection in the ServiceNow AI Platform, which has a CVSS 4.0 score of 9.3/10.
See also: Cloudflare Containers: Security flaw gave access to other people's data
Under certain circumstances, an unauthenticated attacker could execute arbitrary SQL commands on the database backing the affected instance. This poses a particularly serious risk, as a successful attack could lead to reading or modifying data beyond the intended permissions.
The importance of the problem becomes even greater when considering ServiceNow's role in enterprise environments. An instance can include data about IT incidents, employee requests, assets, customers, business processes, and information related to an organization's security.
In other words, a database vulnerability is not necessarily limited to a single application or a limited number of files. Depending on the configuration and data hosted in the specific environment, a breach can have broader business implications.
CVE-2026-86860 is also critical
The second critical issue is CVE-2026-86860, which concerns missing authorization in the AI Platform.
The vulnerability could, under certain circumstances, allow an unauthenticated user to extract data from the instance beyond what should normally be accessible. Exploitation could also lead to privilege escalation, increasing the scope of access an attacker gains.
This particular problem highlights one of the most significant risks in modern enterprise platforms: it is not enough for a system to have strong authentication. It must also accurately control which user or service has access to each data and each function.
Three more high-severity vulnerabilities
The remaining three problems are classified as high severity and are also related to weaknesses in access control.
CVE -2026-86857 is an authorization override vulnerability . In this case, an already authenticated user could gain access to ServiceNow AI Platform data that they are not normally authorized to see. This vulnerability has a CVSS 4.0 score of 8.4
See also: SalesBleed: Vulnerabilities in Salesforce Agentforce for data extraction
CVE -2026-86858, with a score of 8.7, concerns incorrect access control and could, under certain circumstances, allow an unauthenticated attacker to create, modify, or delete instance data. Such a scenario threatens not only the confidentiality, but also the integrity of corporate data.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Finally, CVE-2026-86859, also with a score of 8.7, concerns authorization bypass and could allow an unauthenticated attacker to gain access to data that should normally remain protected.
Why vulnerabilities are especially important in the age of AI
Bringing these problems together in the AI Platform is particularly important as businesses increasingly use artificial intelligence on data and processes that were previously only accessible through traditional applications.
When an AI platform is connected to enterprise databases, workflows, and automation, an authorization issue can have a greater impact. Protection is therefore no longer limited to the AI model, but extends to APIs, databases, identities, user roles, and access mechanisms.
This is also a broader lesson for administrators: the more privileges an AI agent or AI service acquires, the more important the least privilege, so that each account and service has only the capabilities that are absolutely necessary.
Who is the information for?
ServiceNow has already applied the fixes to hosted instances, while the updates have also been made available to partners and customers with self-hosted installations. The company recommends that organizations that have not yet taken the necessary steps to upgrade to fixed versions immediately.
The releases that include the fixes include Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b, Zurich Patch 10 Hot Fix 4a W32, Zurich Patch 11 Hot Fix 3, Australia Patch 2 Hot Fix 4b W32, Australia Patch 4 Hot Fix 3 , and Australia Patch 5.
See also: OnePlus vulnerabilities allow malicious apps to gain root access
Organizations should also confirm which version they are using, check administrator permissions and accounts, and review logs for unusual activity. Pay particular attention to unexpected data changes, suspicious database queries, and attempts to access data that is normally protected.
Although there is no evidence to date that these vulnerabilities have been used in actual attacks, the fact that two of them can directly impact access to corporate data makes patching a priority, especially for online exposures and environments where ServiceNow is a critical part of business workflows.
