Description
ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended.





In August 2026, ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Published: 2026-09-24
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated Privilege Escalation
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an improper access control flaw that allows an unauthenticated user to create, modify, or delete instance data beyond what is allowed by design. This can lead to unauthorized data manipulation or loss of integrity in the ServiceNow AI Platform. The flaw is tied to CWE‑284, indicating weaknesses in access control enforcement.

Affected Systems

The affected product is ServiceNow AI Platform. No specific version details are provided, but the August 2026 update addresses the issue.

Risk and Exploitability

The CVSS score of 8.7 signifies a high severity risk. EPSS is not available, and the vulnerability is not listed in CISA KEV. The likelihood of exploitation is uncertain, but given the unauthenticated nature of the flaw, a potential attacker could exploit the GraphQL interface if it remains accessible without proper authentication checks. No additional prerequisites are noted beyond an unauthenticated request to the GraphQL endpoint.

Generated by OpenCVE AI on September 25, 2026 at 03:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the August 2026 security update or upgrade to a patched release of ServiceNow AI Platform
  • Ensure GraphQL endpoints enforce strict authentication and authorization checks to prevent unauthenticated access
  • Implement monitoring for abnormal GraphQL activity that could indicate privilege escalation attempts

Generated by OpenCVE AI on September 25, 2026 at 03:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Servicenow
Servicenow servicenow Ai Platform
Vendors & Products Servicenow
Servicenow servicenow Ai Platform

Thu, 24 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
Title Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Servicenow Servicenow Ai Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: SN

Published:

Updated: 2026-09-24T19:18:52.579Z

Reserved: 2026-09-08T15:43:12.461Z

Link: CVE-2026-86858

cve-icon Vulnrichment

Updated: 2026-09-24T19:14:29.211Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-24T19:17:18.483

Modified: 2026-09-24T21:00:46.893

Link: CVE-2026-86858

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T07:45:18Z

Weaknesses