CVE-2026-86860 – ServiceNow AI Platform
“When an anonymous user can query your database, every record your business runs on is one request away from exposure.”
ServiceNow has released a security update for the ServiceNow AI Platform that fixes two Critical vulnerabilities, both reachable by unauthenticated users. CVE-2026-13016 has a CVSS score of 9.3, Critical severity. It is a SQL injection flaw that lets an attacker run arbitrary SQL statements against the instance's underlying database and read or modify instance data. CVE-2026-86860 has a CVSS score of 9.3, Critical severity. It is a missing authorization flaw that lets an attacker extract instance data they should not reach, resulting in privilege escalation.
ServiceNow has already deployed the fix to hosted instances. Partners and self-hosted customers must apply the update or upgrade to a patched release now to close both flaws.
Key Details
- CWE Classification
- CWE-862