All vulnerabilities
CVE-2026-13016

Unauthenticated SQL Injection in ServiceNow AI Platform

ServiceNow ServiceNow AI PlatformApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.3Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.

ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Text from CVE List

Affected versions 7

  • ServiceNow AI Platformaffected: all versions before Yokohama Patch 13 Hot Fix 5aCVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 10 Hot Fix 3bCVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 10 Hot Fix 4a W32CVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 11 Hot Fix 3CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 2 Hot Fix 4b W32CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 4 Hot Fix 3CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 5CVE List

References 1