Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-13016, CVE-2026-86860, CVE-2026-86857, CVE-2026-86858, CVE-2026-86859
By Roy Kalfon |
25 September 2026
Multiple CVEs – ServiceNow AI Platform flaws allow unauth SQL injection and access-control bypass for data exposure/modification
ServiceNow AI Platform flaws allow SQL injection by unauthenticated users (arbitrary SQL, data access/modification) and missing authorization/access-control bypass enabling unauthenticated or authenticated users to read, create, modify, or delete unintended instance data (privilege escalation). Upgrade to:
Yokohama – Patch 13 Hot Fix 5a
Zurich – Patch 10 Hot Fix 4a W32 Patch 10 Hot Fix 3b Patch 11 Hot Fix 3
Australia – Patch 2 Hot Fix 4b W32 Patch 4 Hot Fix 3 Patch 5
CVE IDs: CVE-2026-13016, CVE-2026-86860, CVE-2026-86857, CVE-2026-86858, CVE-2026-86859