ServiceNow AI Platform Security Update: Check the September 2026 CVEs

ServiceNow disclosed five new security issues in its AI Platform on September 24, 2026, including an unauthenticated SQL injection flaw rated 9.3 under CVSS 4.0. The practical problem is not simply knowing the CVE numbers: administrators running self-hosted or partner-managed instances need to identify the exact release and hot-fix level before they can tell whether the instance is covered. 

What changed in the September 2026 ServiceNow security update

The September advisory covers CVE-2026-13016, CVE-2026-86857, CVE-2026-86858, CVE-2026-86859, and CVE-2026-86860. They cover several different security boundaries: database queries, authorization checks, access to records, and operations that can change instance data. ServiceNow says the issues were identified through internal security testing, customer security assessments, responsible disclosure, or its bug bounty program, and says it was not aware of malicious exploitation against ServiceNow instances when the advisory was issued. 

The distinction between these flaws matters when assessing exposure. CVE-2026-13016 can allow an unauthenticated user, under the conditions described by ServiceNow, to execute arbitrary SQL statements against the underlying database. CVE-2026-86860 concerns missing authorization that can allow an unauthenticated user to extract instance data beyond intended access. CVE-2026-86859 similarly concerns unauthorized access to records, while CVE-2026-86858 can permit unauthorized creation, modification, or deletion of instance data. CVE-2026-86857 is different because exploitation requires an authenticated user, but that user may reach data they should not be allowed to access. 

Check your ServiceNow build before changing anything

Start by identifying the release family and build information of the affected instance rather than comparing a generic ServiceNow version with the advisory. ServiceNow's diagnostic tools expose instance build information, and the Stats page has traditionally been used to inspect the build name, build date, and build tag. The same page can be opened through the System Diagnostics area, which makes it useful when documenting the current state before a maintenance operation. 

1. Sign in to the ServiceNow instance with an account that can view system diagnostics.
2. Open System Diagnostics and then open Stats.
3. Record the Build name, Build date, and Build tag shown for the instance.
4. Identify whether the instance follows the Yokohama, Zurich, or Australia release family.
5. Keep the recorded build information available while checking the September 2026 patch boundaries.

The result you want from this step is a precise release and patch identity, not simply a statement such as “we run ServiceNow.” That distinction is necessary because the fixed boundary differs between release families. ServiceNow documentation confirms that System Diagnostics is the platform area used for instance diagnostics, while ServiceNow community guidance identifies the Stats page as the place where build information can be inspected. 

Compare the build with the September 2026 patch floors

The Canadian Centre for Cyber Security's September 25 advisory lists the same ServiceNow AI Platform patch boundaries and directs administrators to the vendor's September 2026 CVE notification. The affected ranges are defined as versions before the listed hot fixes or patches, so the comparison must be made against the release family actually installed on the instance. A Zurich installation should therefore be checked against the Zurich boundaries rather than treated as interchangeable with an Australia or Yokohama patch number. 

These are patch boundaries rather than a single universal version number. If your recorded build falls below the applicable boundary for its release stream, treat the instance as requiring the relevant ServiceNow security update or upgrade. The Canadian advisory lists all seven affected boundaries, and independent vulnerability records for the individual CVEs show the same version constraints. 

Check whether your deployment is hosted or self-hosted

The next check is operational rather than technical: determine who maintains the ServiceNow instance. ServiceNow says it deployed the relevant security updates to its hosted instances, while partners and self-hosted customers were provided with updates or patched releases. That means a hosted customer should not assume that a locally performed software upgrade is required simply because the CVEs were published. A self-hosted or partner-managed environment, however, needs its own confirmation that the applicable update has been installed. 

For a managed environment, the useful evidence is the provider's maintenance or patch confirmation together with the instance's current build information. For a self-hosted deployment, retain the update record, the resulting build information, and the date of verification. This gives security teams something stronger than a ticket saying “patched” because the technical state can be checked against the affected version ranges. 

Understand which data protections the five CVEs affect

The five issues are easier to reason about when grouped by what an attacker could cross. CVE-2026-13016 is a SQL injection issue, meaning attacker-controlled input can reach database query processing in a way that was not intended; ServiceNow describes the potential impact as reading or modifying instance data. CVE-2026-86858 concerns improper access control and can allow an unauthenticated user, under certain conditions, to create, modify, or delete instance data. Those two issues therefore make both database access and application-level authorization relevant during a security review. 

CVE-2026-86859 and CVE-2026-86860 focus more directly on unauthorized data access. The former is an authorization bypass that can expose records to an unauthenticated user, while the latter is a missing-authorization issue that can allow extraction of instance data and potentially lead to privilege escalation. CVE-2026-86857 requires an authenticated user but can still cross an authorization boundary and expose data that the account should not be entitled to access. The common thread is not a single attack technique but failures in deciding what a request is allowed to see or change. 

Review access records after the patch is verified

ServiceNow stated that it was not aware of malicious exploitation associated with these five issues when it disclosed them, so there is no vendor-confirmed incident to investigate simply because an instance was potentially affected. That does not mean an organization should erase the distinction between vulnerability remediation and incident review. If an affected self-hosted instance was exposed for a meaningful period, security teams can review the available application, authentication, and administrative records for unusual access rather than assuming that successful patching proves nobody reached the vulnerable functionality. 

Focus the review on activity that does not fit the normal behavior of the instance: unexpected unauthenticated requests, unusual record access, unexplained administrative activity, and changes that cannot be tied to a legitimate user or integration. Do not treat every unusual request as evidence of exploitation because normal integrations can generate high-volume or unfamiliar traffic. The useful outcome is a documented assessment showing what period was reviewed, which logs were available, what anomalies were found, and whether further investigation is warranted.

Verify the remediation instead of stopping at the change ticket

After applying the update, repeat the version check from the first step and compare the resulting build against the correct release-family boundary. This second check is the simplest way to catch a common operational failure: an update was requested or scheduled, but the instance is still running an older build. ServiceNow's advisory and the Canadian Centre's notice both frame the remediation around the applicable patched release, so the final verification should record the actual build rather than merely the intended maintenance action.

A complete verification record should contain the instance environment, release family, build information, applicable patch boundary, update or upgrade performed, and the date of the post-update check. If multiple instances exist, perform the comparison separately for each one because a single maintenance record can hide differences between environments. The check is complete when every relevant instance is either confirmed at or above its applicable fixed boundary or has a documented remediation plan with an owner and maintenance window.

What to watch after the September update

The September disclosure is a reminder that security review for an AI-enabled enterprise platform cannot stop at checking whether a feature is enabled. Four of these five issues can affect unauthenticated requests under the conditions described by their CVE records, while the fifth crosses an authorization boundary for an authenticated user. That makes release management, access control, and post-update verification parts of the same security task rather than separate maintenance chores.

For administrators, the next useful action is straightforward: identify every ServiceNow AI Platform instance you operate, record its exact build, compare it with the September 2026 patch floor for that release family, and verify the result after maintenance. ServiceNow's current advisory does not report malicious exploitation of these five issues, but that status can change independently of the patching process. Keeping the build inventory and remediation evidence current means a later security advisory can be checked against real deployments instead of reconstructed from memory.