vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-86858

Unauthenticated Privilege Escalation via GraphQL in ServiceNow AI Platform

HIGH
8.7
CVSS Score
Published: September 24, 2026 at 06:42 PM UTC
Updated: September 24, 2026 at 09:17 PM UTC
1 product affected across 1 vendorAI Platform

Using ServiceNow AI Platform by ServiceNow?

Get instant alerts when new vulnerabilities affect ServiceNow AI Platform - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.7
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

AI Platform· Servicenow
60%
v < Australia Patch 2 Hot Fix 4b W32v < Australia Patch 4 Hot Fix 3v < Australia Patch 5v < Yokohama Patch 13 Hot Fix 5av < Zurich Patch 10 Hot Fix 3bv < Zurich Patch 10 Hot Fix 4a W32v < Zurich Patch 11 Hot Fix 3
Affected range stops below Australia Patch 2 Hot Fix 4b W32, so it looks safe — our inference, not a vendor statement
Affected range stops below Australia Patch 4 Hot Fix 3, so it looks safe — our inference, not a vendor statement
Affected range stops below Australia Patch 5, so it looks safe — our inference, not a vendor statement
Affected range stops below Yokohama Patch 13 Hot Fix 5a, so it looks safe — our inference, not a vendor statement
Affected range stops below Zurich Patch 10 Hot Fix 3b, so it looks safe — our inference, not a vendor statement
Affected range stops below Zurich Patch 10 Hot Fix 4a W32, so it looks safe — our inference, not a vendor statement
Affected range stops below Zurich Patch 11 Hot Fix 3, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (1)

Source: cverecord
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.7HIGHSN
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-284

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card