Posted on

ServiceNow AI Platform – Critical Unauthenticated Authorization and SQL Injection Vulnerability Cluster

Threat Overview

ServiceNow disclosed five vulnerabilities affecting the ServiceNow AI Platform on September 24. The set includes critical unauthenticated authorization weaknesses and an unauthenticated SQL-injection issue, with potential outcomes including sensitive instance-data extraction, data modification, privilege escalation, and SQL execution. CVE-2026-86860 is a vendor-assigned CVSS 9.3 missing-authorization vulnerability. ServiceNow states hosted instances received security updates and that updates were provided to partners and self-hosted customers.

References

  • ServiceNow/CVE record, September 24, 2026 – CVE-2026-86860, vendor reference KB3159623
  • CVE-2026-86860 record, published September 24, 2026
  • ServiceNow September 2026 security update reporting covering CVE-2026-13016, CVE-2026-86857, CVE-2026-86858, CVE-2026-86859 and CVE-2026-86860

Impacted Systems

ServiceNow AI Platform. For CVE-2026-86860, affected releases are below the vendor patch floors for the applicable family, including Yokohama Patch 13 Hot Fix 5a; Zurich Patch 10 Hot Fix 3b / Patch 10 Hot Fix 4a W32 / Patch 11 Hot Fix 3; Australia Patch 2 Hot Fix 4b W32 / Patch 4 Hot Fix 3 / Patch 5. Hosted instances were updated by ServiceNow; partner-managed and self-hosted customers must verify their patch level.

Why this matters

ServiceNow commonly stores sensitive business data and orchestrates privileged workflows. Unauthenticated data extraction, SQL execution, data modification, or privilege escalation could expose data and create a path to higher-trust workflows.

Exploitation Status

ServiceNow states it is not currently aware of malicious exploitation. No CISA KEV listing or verified in-the-wild exploitation was identified for this cluster as of the report date. This is a patch/exposure priority, not an active-exploitation claim.

What this hunt looks for

Unusual unauthenticated requests to known ServiceNow instance destinations, rare source IPs, high-volume API activity, unusual authentication changes, and downstream Entra sign-in anomalies where ServiceNow is integrated with enterprise identity.

Required logs

WAF/reverse-proxy telemetry in CommonSecurityLog when customer-managed ServiceNow ingress is logged, Microsoft Entra SigninLogs for federated identity activity, and ServiceNow audit/application logs when already forwarded into Sentinel.

First Pass – Rare Sources to Known ServiceNow Destinations

let Baseline=CommonSecurityLog
| where TimeGenerated between (ago(30d)..ago(7d))
| where RequestURL has "service-now.com"
| summarize by SourceIP,DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has "service-now.com"
| join kind=leftanti Baseline on SourceIP,DestinationIP
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

High-Volume ServiceNow Requests

CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has "service-now.com"
| summarize Requests=count(),URLs=dcount(RequestURL),Methods=make_set(RequestMethod,10) by SourceIP,DestinationIP,bin(TimeGenerated,5m)
| where Requests >= 100
| order by Requests desc

ServiceNow POST PUT PATCH DELETE Activity

CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has "service-now.com"
| where RequestMethod in~ ("POST","PUT","PATCH","DELETE")
| project TimeGenerated,SourceIP,DestinationIP,RequestMethod,RequestURL,DeviceAction,Message
| order by TimeGenerated desc

ServiceNow Sign-Ins from New IPs

let Baseline=SigninLogs
| where TimeGenerated between (ago(30d)..ago(7d))
| where AppDisplayName has "ServiceNow" and ResultType == 0
| summarize by UserPrincipalName,IPAddress;
SigninLogs
| where TimeGenerated >= ago(7d)
| where AppDisplayName has "ServiceNow" and ResultType == 0
| join kind=leftanti Baseline on UserPrincipalName,IPAddress
| project TimeGenerated,UserPrincipalName,IPAddress,Location,AppDisplayName,ClientAppUsed,AuthenticationRequirement,ConditionalAccessStatus
| order by TimeGenerated desc

ServiceNow Successful Sign-Ins Without MFA

SigninLogs
| where TimeGenerated >= ago(7d)
| where AppDisplayName has "ServiceNow"
| where ResultType == 0
| where AuthenticationRequirement !~ "multiFactorAuthentication"
| project TimeGenerated,UserPrincipalName,IPAddress,Location,AppDisplayName,ClientAppUsed,AuthenticationRequirement,ConditionalAccessStatus
| order by TimeGenerated desc

ServiceNow Authentication Failures by User

SigninLogs
| where TimeGenerated >= ago(7d)
| where AppDisplayName has "ServiceNow"
| where ResultType != 0
| summarize Failures=count(),SourceIPs=dcount(IPAddress),IPs=make_set(IPAddress,20) by UserPrincipalName,bin(TimeGenerated,1h)
| where Failures >= 10
| order by Failures desc

Detection Notes

ServiceNow has not published a verified exploit request signature or IOC set for these vulnerabilities. Hosted instances have been patched by ServiceNow. CommonSecurityLog queries only apply where ServiceNow-facing proxy/WAF telemetry is ingested and should be scoped to the customer’s known instance hostname or destination IP. Entra queries detect identity anomalies but do not directly detect exploitation.

Leave a comment