CVE-2026-86857

Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in ServiceNow AI Platform

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: ServiceNow

Description

ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an authenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access, potentially enabling further unintended access. ServiceNow deployed an update to hosted instances, and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-86857

EUVD

EUVD-2026-86393

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in the ServiceNow AI Platform. An authenticated user could exploit it to access data they are not entitled to, potentially leading to further unauthorized access.

Detection Guidance

This vulnerability is specific to ServiceNow AI Platform and requires authentication. Detection involves checking ServiceNow instance versions and configurations for the patched release. Review ServiceNow's official documentation for version checks and apply their provided detection tools if available.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data within the ServiceNow AI Platform, potentially leading to data breaches or further security compromises.

Compliance Impact

The vulnerability allows unauthorized access to sensitive data, which could lead to violations of data protection regulations like GDPR and HIPAA. Unauthorized access risks exposing personal or health information, potentially resulting in non-compliance with these standards.

Mitigation Strategies

Apply the provided update or upgrade to a patched release immediately. Ensure all ServiceNow AI Platform instances are updated to the latest secure version. Monitor ServiceNow advisories for further guidance.

Hi! I’m here to help you understand CVE-2026-86857. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70