ServiceNow patches SQL injection flaw in its AI Platform

ServiceNow has fixed a SQL injection vulnerability in the ServiceNow AI Platform that could have allowed an unauthenticated user to run arbitrary database commands against a customer instance. The flaw, tracked as CVE-2026-13016, was published in the US National Vulnerability Database on 24 September 2026. According to the entry, the vulnerability could in certain circumstances let an attacker "gain access to, or modify, instance data beyond what was intended".

SQL injection is an old and well-understood class of bug. It happens when input supplied by a user is passed into a database query without being properly separated from the query's own instructions, so that the input is treated as commands rather than as data. The consequence is that someone outside the system can read records they should never see, and in many cases change or delete them too.

What makes this one notable is where it sits. The ServiceNow AI Platform is the layer that customers use to build and run automated workflows and agents against their own corporate records. An instance database on that platform typically holds the operational data those workflows act on. A flaw that allows unauthenticated access to that database is therefore a flaw in the foundations, not in the model layer. No authentication was required, according to the advisory, which removes the usual first barrier an attacker has to clear.

ServiceNow said it has deployed a security update to hosted instances, and has provided the same update to its partners and to self-hosted customers. The company said it is "not currently aware of malicious exploitation against ServiceNow instances". It recommended that customers promptly apply the appropriate updates, or upgrade to a patched release, if they have not already done so. That instruction matters most for self-hosted deployments, where the fix does not arrive automatically and the work falls to the customer's own administrators.

The advisory does not say how long the vulnerability existed, how it was found, or which component of the platform was affected. It does not name a researcher or reporting party. It does not describe the specific circumstances under which the flaw could be triggered, beyond the phrase "in certain circumstances". ServiceNow has published a knowledge base article with further detail for customers.

For organisations running agent workflows on the platform, the practical question is whether their instance has already received the update. Hosted customers are covered by ServiceNow's own deployment. Everyone else needs to check their release version against the patched one listed in the vendor's knowledge base article.

The case is a reminder that agent platforms inherit every risk of the conventional software they are built on. Much of the current attention on agent security is focused on prompt injection, tool misuse and the behaviour of models themselves. This vulnerability involved none of those things. It was a database query handling error of a type that predates large language models by decades, sitting underneath a product marketed for AI-driven automation. The data an agent can reach is only as protected as the database that stores it.

ServiceNow has classed the issue as remediated. No customer impact has been reported.