CVE-2026-86859
Awaiting Analysis Awaiting Analysis - Queue

Authorization Bypass in ServiceNow AI Platform

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: ServiceNow

Description
ServiceNow has remediated an authorization bypass security issue that was identified in the ServiceNow AI Platform. This security issue, if exploited, could enable an unauthenticated user to access data within the ServiceNow AI Platform that the user otherwise would not be entitled to access, potentially enabling further unintended access. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-86859
EUVD
EUVD-2026-86400

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in the ServiceNow AI Platform. It allows an unauthenticated user to access data they are not entitled to, potentially leading to further unauthorized access.

Detection Guidance

This vulnerability is specific to ServiceNow AI Platform and requires checking the version of your ServiceNow instance. Ensure you are running a patched version as ServiceNow has already deployed security updates to hosted instances and provided updates to partners and self-hosted customers.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive data within the ServiceNow AI Platform without proper authorization, risking data breaches or unauthorized modifications.

Compliance Impact

The vulnerability could allow unauthorized access to sensitive data, which may violate compliance requirements under GDPR and HIPAA if such data is involved. Unauthorized access risks exposing personal or health information, leading to potential regulatory penalties.

Mitigation Strategies

Apply the security update provided by ServiceNow immediately. For hosted instances, updates are already deployed. For self-hosted instances or partners, upgrade to the patched release as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart