CVE-2026-86859 Overview
ServiceNow has remediated an authorization bypass vulnerability in the ServiceNow AI Platform. The flaw allows an unauthenticated remote attacker to access data within the platform that the attacker would not otherwise be entitled to retrieve. Successful exploitation could enable further unintended access to platform resources.
ServiceNow has deployed a security update to hosted instances and provided updates to partners and self-hosted customers. ServiceNow states it is not currently aware of malicious exploitation against ServiceNow instances. The weakness is classified as Improper Access Control [CWE-284].
Critical Impact
An unauthenticated attacker can bypass authorization controls over the network and retrieve restricted data from the ServiceNow AI Platform without user interaction.
Affected Products
- ServiceNow AI Platform (hosted instances)
- ServiceNow AI Platform (self-hosted customer deployments)
- ServiceNow AI Platform (partner-managed deployments)
Discovery Timeline
- 2026-09-24 - CVE CVE-2026-86859 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-86859
Vulnerability Analysis
The vulnerability is an authorization bypass in the ServiceNow AI Platform. An unauthenticated user can reach platform functionality or data without passing the access control checks that would normally gate those resources. The issue is classified under [CWE-284] Improper Access Control.
The attack vector is network-based and requires no privileges or user interaction. Only confidentiality is directly impacted by the public advisory; integrity and availability are not listed as affected. The weakness, however, could serve as a pivot for further unintended access elsewhere in the platform, according to ServiceNow.
Root Cause
The root cause is improper enforcement of authorization checks within the ServiceNow AI Platform. The platform fails to verify that a requesting user is entitled to the data being returned, allowing unauthenticated callers to retrieve restricted information. ServiceNow has not published the specific component or endpoint affected.
Attack Vector
Exploitation occurs over the network against an exposed ServiceNow AI Platform instance. The attacker does not need valid credentials, prior access, or user interaction. ServiceNow has not released public exploit code, and no proof-of-concept has been published at the time of this writing. The EPSS exploit probability stands at 0.29% (percentile 19.495) as of 2026-10-01.
No verified code example is available. Refer to the ServiceNow Knowledge Base Article KB3159623 for vendor-provided technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-86859
Indicators of Compromise
- Unauthenticated HTTP requests to ServiceNow AI Platform endpoints that return non-empty response bodies containing business or configuration data.
- Anomalous volumes of requests originating from a single IP address targeting AI Platform API paths without prior authentication events.
- Access log entries showing successful (2xx) responses for API routes that normally require an authenticated session token.
Detection Strategies
- Review ServiceNow access and transaction logs for requests to AI Platform endpoints that lack a corresponding authenticated session identifier.
- Correlate web application firewall (WAF) telemetry with ServiceNow instance logs to identify requests that reach protected resources without a prior login event.
- Baseline normal API usage per user and instance, then alert on deviations such as unauthenticated callers reaching restricted paths.
Monitoring Recommendations
- Enable verbose logging on ServiceNow AI Platform endpoints and forward logs to a centralized SIEM for retention and correlation.
- Monitor outbound data transfer from ServiceNow instances for unusual spikes that could indicate bulk data retrieval.
- Track administrative and audit events for configuration changes made shortly after suspicious unauthenticated requests.
How to Mitigate CVE-2026-86859
Immediate Actions Required
- Apply the security update provided by ServiceNow to all self-hosted and partner-managed ServiceNow AI Platform deployments.
- Confirm that hosted ServiceNow instances have received the vendor-deployed patch by validating the current build version against the KB advisory.
- Audit ServiceNow access logs for the preceding 90 days to identify any unauthenticated requests that returned restricted data.
Patch Information
ServiceNow has deployed a security update to all hosted instances and has distributed the update to partners and self-hosted customers. Customers should promptly apply the appropriate updates or upgrade to a patched release. Full remediation details are documented in the ServiceNow Knowledge Base Article KB3159623.
Workarounds
- Restrict network exposure of ServiceNow AI Platform endpoints to trusted corporate ranges using firewall or reverse-proxy access control lists until patching is confirmed.
- Enforce strict authentication requirements at the perimeter via a WAF or API gateway to block unauthenticated requests to AI Platform routes.
- Review and tighten role-based access control (RBAC) assignments within ServiceNow to minimize the data accessible through any single bypass.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
