All vulnerabilities
CVE-2026-86859

Unauthenticated Arbitrary Record Disclosure in ServiceNow AI Platform

ServiceNow ServiceNow AI PlatformApplications & CMS
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Sep 2026Updated 24 Sep 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access, potentially enabling further unintended access.

ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Text from CVE List

Affected versions 7

  • ServiceNow AI Platformaffected: all versions before Yokohama Patch 13 Hot Fix 5aCVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 10 Hot Fix 3bCVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 10 Hot Fix 4a W32CVE List
  • ServiceNow AI Platformaffected: all versions before Zurich Patch 11 Hot Fix 3CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 2 Hot Fix 4b W32CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 4 Hot Fix 3CVE List
  • ServiceNow AI Platformaffected: all versions before Australia Patch 5CVE List

References 1