ServiceNow (NYSE: NOW) fixed five AI Platform flaws in its September 2026 advisory, and four are open to attackers who never log in. The worst, CVE-2026-13016, is a critical SQL injection that could run arbitrary commands against an instance’s database.
The Brief
- ServiceNow rated two of the five flaws critical, a SQL injection bug and a missing-authorization bug that exposes instance data.
- Four of the five bugs need no authentication, so an attacker would not need a valid account to reach instance data.
- ServiceNow says it has seen no evidence of exploitation in the wild and has already updated its hosted instances.
- Self-hosted customers and partners need to install fixed builds such as Zurich Patch 11 Hot Fix 3 or Australia Patch 5.
Four of five flaws skip the login
CVE-2026-13016 is the bug to fix first. ServiceNow says that “in certain circumstances,” an unauthenticated user could execute arbitrary SQL statements against the underlying database. That access could expose or modify instance data beyond what was intended.
Companies run IT operations, security incidents, employee requests, asset records and customer data through the platform. A database-level bug reaches all of it, the same reason SAP’s critical S/4HANA and NetWeaver bugs drew urgent attention.
CVE-2026-86860, the second critical flaw, is a missing-authorization issue. ServiceNow warned it could let an unauthenticated attacker extract instance data beyond intended access controls and could lead to privilege escalation. The other three carry a high rating in advisory KB3159623:
| CVE | Rating | Flaw type | Login needed | Possible impact |
|---|---|---|---|---|
| CVE-2026-13016 | Critical | SQL injection | No | Run arbitrary SQL, read or modify data |
| CVE-2026-86860 | Critical | Missing authorization | No | Extract data, escalate privileges |
| CVE-2026-86858 | High | Improper access control | No | Create, modify or delete data |
| CVE-2026-86859 | High | Authorization bypass | No | Access restricted data |
| CVE-2026-86857 | High | Authorization bypass | Yes | See data the user isn’t entitled to |
CVE-2026-86858 deserves more attention than its rating suggests. Under certain conditions, it lets an unauthenticated attacker create, modify or delete records, so the risk covers tampering as well as leaks. Altered incident tickets can quietly mislead the responders reading them.
Self-hosted instances carry the exposure
ServiceNow deployed the fix to hosted instances and shipped it to partners and self-hosted customers. Members of its August Patching Program already have it. Everyone else running their own instances should be on a remediated release:
- Yokohama: Patch 13 Hot Fix 5a
- Zurich: Patch 10 Hot Fix 3b, Patch 10 Hot Fix 4a W32, or Patch 11 Hot Fix 3
- Australia: Patch 2 Hot Fix 4b W32, Patch 4 Hot Fix 3, or Patch 5
“We are not currently aware of malicious exploitation against ServiceNow instances,” the company said in its advisory text. That statement covers what ServiceNow has seen; self-hosted operators are better placed than the vendor to check their own logs.
The public record leaves gaps. The GitHub Advisory Database entry for CVE-2026-13016 (GHSA-89wx-h2m8-fc58) lists affected and patched versions as “Unknown” and is still unreviewed. Open questions include:
- What “certain circumstances” make the SQL injection reachable without a login?
- Which release families were vulnerable before the fixed builds shipped?
- Do the flaws sit in AI-specific features or in the platform core?
- Which route found each bug: internal testing, customer assessments, responsible disclosure or the bug bounty program?
The AI branding shouldn’t distract from the bug class, since SQL injection long predates the AI label on the product. Salesforce’s ForcedLeak prompt injection bug showed the newer kind of AI risk; this advisory shows the older kind hasn’t gone away.
What’s Next?
Self-hosted admins have a clear order of work. Confirm the deployed version against the list above, patch, then review administrative access. Watching for unusual database queries, unexpected data changes and unauthorized access attempts afterward helps reduce the risk that earlier abuse goes unnoticed.
Hosted customers and August Patching Program members are covered, so the open exposure is any self-run instance below the listed builds. Until those instances move up, two critical bugs stay reachable by anyone who can hit the instance, with no account required.
