ServiceNow AI Platform SQL injection vulnerability CVE-2026-13016

ServiceNow remediated a SQL injection vulnerability in its AI Platform that could allow unauthenticated users to execute arbitrary SQL statements and access or modify database data. No malicious exploitation has been reported.

Disclosed 24 September 2026 · Record updated 1 October 2026

Impact

Unauthenticated users could execute arbitrary SQL statements and gain access to or modify instance data beyond intended scope

Our coverage

A shadowy figure inserts a corrupted key into a locked database vault, bypassing guards, while technicians frantically seal the breach with reinforced steel plating.

Vulnerabilities

ServiceNow patches SQL injection flaw in its AI Platform

The company says an unauthenticated user could in some cases run arbitrary SQL against an instance's database, but it has seen no malicious exploitation.

24 Sept 2026

Sources

nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-13016