AiCybr

ServiceNow AI Platform September 2026 Security Update: Five CVEs and Patch Floors

By AiCybr Editorial · Published September 25, 2026

ServiceNow disclosed five security vulnerabilities in the ServiceNow AI Platform on September 24, 2026. The set includes an unauthenticated SQL-injection flaw, unauthenticated data-access and data-modification weaknesses, a missing-authorization issue that can lead to privilege escalation, and an authorization bypass affecting authenticated users.

ServiceNow says it has already deployed the relevant security updates to hosted instances and supplied updates to partners and self-hosted customers. The company reported no evidence of malicious exploitation related to these five issues at disclosure. Self-hosted and partner-managed environments need to verify their own installed patch or hot-fix level because the vendor-managed hosted remediation does not establish their update status.

The five CVEs are CVE-2026-13016, CVE-2026-86860, CVE-2026-86859, CVE-2026-86858 and CVE-2026-86857. ServiceNow's affected-version records use the same fixed patch floors across the current Yokohama, Zurich and Australia release families.

Five vulnerabilities in the September advisory

CVE Severity Access required Material impact
CVE-2026-13016 Critical Unauthenticated SQL injection can execute arbitrary SQL against the underlying instance database and expose or modify instance data
CVE-2026-86860 Critical Unauthenticated Missing authorization can allow extraction of instance data and lead to privilege escalation
CVE-2026-86859 High Unauthenticated Authorization bypass can expose data the requester is not entitled to access and enable further unintended access
CVE-2026-86858 High Unauthenticated Improper access control can allow creation, modification or deletion of instance data
CVE-2026-86857 High Authenticated Authorization bypass can expose data outside the authenticated user's intended access scope

The practical priority is highest for internet-reachable or otherwise exposed self-hosted environments below the fixed patch floors. Four of the five issues can be reached without authentication under the conditions described by ServiceNow; CVE-2026-86857 requires an authenticated user.

Fixed patch levels

ServiceNow's records identify versions earlier than the following releases as affected. Administrators should verify the applicable release family and patch stream for each instance:

  • Yokohama: Patch 13 Hot Fix 5a
  • Zurich: Patch 10 Hot Fix 3b
  • Zurich: Patch 10 Hot Fix 4a W32
  • Zurich: Patch 11 Hot Fix 3
  • Australia: Patch 2 Hot Fix 4b W32
  • Australia: Patch 4 Hot Fix 3
  • Australia: Patch 5

These are patch boundaries, not interchangeable version labels. A Zurich deployment, for example, should be compared against the branch it actually follows. ServiceNow's advisory is the authoritative source for determining the appropriate update path for a specific instance.

What administrators should verify

Start with the exact ServiceNow release and patch/hot-fix level running on every self-hosted or partner-managed instance. Compare that inventory with the September advisory and move affected systems to the applicable fixed release.

For ServiceNow-hosted instances, the vendor says the security update has already been deployed. Organizations should still confirm their instance status through normal ServiceNow administration and change-management records, particularly where regulated environments require evidence that a remediation was applied.

For self-hosted systems, prioritize instances reachable from untrusted networks and review access controls around administrative and integration interfaces while the update is being applied. CVE-2026-13016 is especially consequential because ServiceNow describes an unauthenticated path to arbitrary SQL statements against the instance database.

After patching, review application, authentication and administrative logs for unexpected access or data changes during the period in which the instance was below the fixed level. ServiceNow reported no known malicious exploitation when the advisory was issued. The log review provides a precautionary exposure check for systems that were previously below the fixed patch level.

Why this update matters

The September set is operationally significant because several flaws cross authorization boundaries without requiring an authenticated account. The affected functionality sits inside an enterprise platform that commonly holds workflow, configuration and business data, making accurate patch-level inventory more useful than tracking the CVE identifiers alone.

The disclosure also separates hosted and self-hosted response responsibilities. ServiceNow applied the fixes to its hosted fleet, while partners and self-hosted customers received updates that they must verify in their own environments. That distinction determines whether an administrator needs to schedule an upgrade or primarily document the vendor-managed remediation.

Sources

Continue reading

Cybersecurity ServiceNow August 2026 Critical CVEs: What to Patch and Why

ServiceNow patched three CVSS 10.0 flaws and a sandbox escape affecting AI Platform and Now Platform releases. Here is the operator-focused version map and remediation checklist.

Cybersecurity NVIDIA Infrastructure Controller 2.0 Fixes Critical CVE-2026-65113 and 13 More Flaws

NVIDIA Infrastructure Controller 2.0 fixes 14 vulnerabilities affecting Linux versions 0 through 1.9, led by the CVSS 9.8 hard-coded-credentials flaw CVE-2026-65113.

Cybersecurity HP Advance HPSBPI04149: Update AC Print & Scan and Output Central

HP HPSBPI04149 fixes three network-reachable vulnerabilities in HP Advance software. AC Print & Scan needs V1R4.0.027 or later and Output Central needs V1R4.0.029.