Missing Authorization Vulnerability in ServiceNow AI Platform
CVE-2026-86860

9.3CRITICAL

Key Information:

Vendor

Servicenow

Status
Servicenow Ai Platform
Vendor
CVE Published:
24 September 2026

What is CVE-2026-86860?

A missing authorization vulnerability was identified in the ServiceNow AI Platform, potentially allowing unauthenticated users to extract sensitive instance data beyond intended access levels. This could lead to unauthorized privilege escalation. ServiceNow has implemented a security update for hosted instances and has provided necessary updates to their partners and self-hosted customers. It is crucial for users to apply the updates promptly to safeguard their data and maintain system integrity.

Affected Version(s)

ServiceNow AI Platform 0

ServiceNow AI Platform 0

ServiceNow AI Platform 0

References

https://support.servicenow.com/kb?id=kb_article_view&sysp...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.