Critical ServiceNow Vulnerabilities Allow Authorization Bypass, Data Access
ServiceNow has released updates to address five vulnerabilities in its AI Platform, including two critical flaws that could permit unauthenticated attackers to bypass authorization and access sensitive data.
ServiceNow has issued security updates to patch five vulnerabilities discovered within its AI Platform, with two of these flaws rated as critical. These critical vulnerabilities, CVE-2026-13016 and CVE-2026-86860, pose a significant risk as they allow unauthenticated attackers to bypass authorization mechanisms. This could grant them the ability to access, modify, or even extract sensitive data stored within affected ServiceNow instances.
In addition to the critical vulnerabilities, three high-severity flaws have also been addressed. These include CVE-2026-86857, CVE-2026-86858, and CVE-2026-86859, all of which involve weaknesses in authorization and access control. While ServiceNow has stated that there is no evidence of these vulnerabilities being exploited in the wild, the potential impact necessitates prompt action, especially for instances that are internet-facing or handle critical enterprise data.
The most severe of the disclosed issues, CVE-2026-13016, is a critical SQL injection vulnerability. Under specific circumstances, an unauthenticated attacker could leverage this flaw to execute arbitrary SQL commands against the instance's underlying database. A successful exploitation could lead to the unauthorized reading, modification, or manipulation of data, presenting substantial risks for organizations relying on ServiceNow for managing IT service operations, security incidents, employee requests, and other core business processes.
CVE-2026-86860, another critical vulnerability, is described as a missing-authorization flaw. This vulnerability could enable an unauthenticated attacker to extract instance data that should be beyond their permitted access levels. ServiceNow warns that exploitation of this flaw could potentially lead to privilege escalation, granting attackers higher access rights or data permissions than they are entitled to.
The advisory, KB3159623, details the remaining high-severity vulnerabilities. CVE-2026-86857 is an authorization bypass that could allow an authenticated user to access data they are not authorized to view within the AI Platform. CVE-2026-86858, an improper access control issue, could permit an unauthenticated attacker to create, modify, or delete instance data outside of their intended permissions, potentially disrupting operations and data integrity. Lastly, CVE-2026-86859 is another authorization bypass, but this one could allow an unauthenticated attacker to access restricted data within the ServiceNow AI Platform.
ServiceNow has indicated that customers participating in its August Patching Program have already received the necessary fixes. However, customers who self-host their ServiceNow instances are strongly urged to upgrade or apply the relevant updates immediately. Patched versions include Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 4a W32, and Australia Patch 2 Hot Fix 4b W32, along with other specific hotfix releases for Zurich and Australia versions.
Organizations are advised to confirm their current deployed version and ensure all updates are applied. Post-patching, it is crucial to review administrative access logs and monitor for any unusual database queries, unexpected data modifications, or signs of unauthorized access attempts. Proactive monitoring and timely patching are essential to mitigate the risks associated with these critical authorization bypass and data access vulnerabilities.