Critical Flaws in ServiceNow AI Platform Expose Enterprise Data via Unauthenticated SQLi

ServiceNow released patches addressing five distinct security vulnerabilities within its ServiceNow AI Platform subsystem, cataloged under advisory KB3159623. The patch release is headlined by CVE-2026-13016, a critical unauthenticated SQL injection flaw that allows remote threat actors to execute arbitrary database commands without prior privilege. Alongside this, ServiceNow resolved a critical missing authorization vulnerability (CVE-2026-86860) and three high-severity flaws (CVE-2026-86857, CVE-2026-86858, and CVE-2026-86859) capable of enabling unauthenticated data extraction, modification, and privilege escalation. While ServiceNow reported no active in-the-wild exploitation, the advisory mandates immediate remediation across supported release families, including Yokohama and Zurich. This advisory is particularly critical for DevSecOps and enterprise engineering teams because ServiceNow instances operate as central clearinghouses for infrastructure metadata, IT operations, change management approvals, and incident response data. If an adversary leverages unauthenticated SQL injection or authorization bypasses against this hub, they can access sensitive tenant data, alter production release approvals, or pivot into integrated CI/CD and cloud operational environments. The vulnerability demonstrates that embedding AI query and processing services directly into enterprise management control planes creates fresh, high-leverage entry points if standard input sanitization and granular authorization boundaries are not enforced consistently. In the broader DevOps landscape, organizations have aggressively integrated AI layers into operational toolchains—from automated change-request summarization to intelligent incident triage. However, this architectural shift often outpaces traditional shift-left security practices. While AI frontends often receive heavy testing for natural language safety, the underlying database endpoints, GraphQL schemas, and RPC layers still suffer from classic vulnerability classes like SQL injection and broken access controls. The ServiceNow disclosure underscores that securing the AI stack requires the same rigorous API contract testing and continuous SAST/DAST pipeline enforcement applied to standard web microservices. In practice, platform engineering and DevSecOps teams operating on-premises or self-hosted ServiceNow deployments must immediately verify their instance patch levels and apply the latest hotfixes. Beyond applying the vendor patch, teams should review outbound and inbound access controls protecting ITSM integration endpoints, rotate any sensitive service credentials stored in affected records, and audit recent query telemetry for irregular unauthenticated requests to AI platform endpoints. Going forward, DevSecOps pipelines integrating enterprise automation platforms must enforce runtime validation and strict network isolation for AI extension endpoints.