All vulnerabilities
CVE-2026-86858

Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform

ServiceNow ServiceNow AI PlatformApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended.

In August 2026, ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Text from CVE List

Affected versions 7

  • ServiceNow AI Platformaffected: all versions before Yokohama Patch 13 Hot Fix 5aCVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 10 Hot Fix 3bCVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 10 Hot Fix 4a W32CVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 11 Hot Fix 3CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 2 Hot Fix 4b W32CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 4 Hot Fix 3CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 5CVE List

References 1