Critical ServiceNow Vulnerabilities Let Attackers Bypass Authorization – Update Now!

ServiceNow released security updates for five AI Platform flaws, including two critical vulnerabilities that could let unauthenticated attackers access, modify, or extract sensitive instance data, urging self-hosted users to verify versions and patch promptly. ServiceNow advisory covers CVE-2026-86857, CVE-2026-86858, CVE-2026-13016, CVE-2026-86859, and CVE-2026-86860, identified through internal testing, customer assessments, responsible disclosures, and its bug bounty program. The company stated it has not identified evidence that attackers have exploited the flaws in the wild. However, the technical impact of the issues makes rapid patching important, particularly for instances exposed to the internet or connected to sensitive...

Read the full article at the source.