SQL Injection Vulnerability in ServiceNow AI Platform
CVE-2026-13016

9.3CRITICAL

Key Information:

Vendor

Servicenow

Status
Servicenow Ai Platform
Vendor
CVE Published:
24 September 2026

What is CVE-2026-13016?

A SQL injection vulnerability was discovered in the ServiceNow AI Platform, allowing unauthenticated users under specific conditions to execute unauthorized arbitrary SQL statements against the database. This could lead to unauthorized access to or modification of sensitive instance data. ServiceNow has issued a security update to mitigate this risk and advises customers to implement the updates promptly to secure their instances.

Affected Version(s)

ServiceNow AI Platform 0

ServiceNow AI Platform 0

ServiceNow AI Platform 0

References

https://support.servicenow.com/kb?id=kb_article_view&sysp...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Kues - Assetnote
.