WID-SEC-W-2026-3582
Vulnerability from csaf_certbund - Published: 2026-09-24 22:00 - Updated: 2026-09-24 22:00Summary
ServiceNow AI Platform: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Die ServiceNow AI Platform ist eine Sammlung von KI-gestützten Funktionen, die in die ServiceNow-Plattform integriert sind, um Arbeitsabläufe zu automatisieren und Entscheidungen zu verbessern.
Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ServiceNow AI Platform ausnutzen, um unberechtigt auf Instanzdaten zuzugreifen, Daten zu erstellen, zu verändern oder zu löschen, beliebige SQL-Anweisungen gegen die zugrunde liegende Datenbank auszuführen und unter bestimmten Umständen seine Berechtigungen zu erweitern.
Betroffene Betriebssysteme: - Sonstiges
Affected products
Known affected
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
ServiceNow AI Platform Australia <Patch 5
ServiceNow / AI Platform
|
Australia <Patch 5 | ||
|
ServiceNow AI Platform Australia <Patch 4 Hot Fix 3
ServiceNow / AI Platform
|
Australia <Patch 4 Hot Fix 3 | ||
|
ServiceNow AI Platform Yokohama <Patch 13 Hot Fix 5a
ServiceNow / AI Platform
|
Yokohama <Patch 13 Hot Fix 5a | ||
|
ServiceNow AI Platform Australia W32 <Patch 2 Hot Fix 4b W32
ServiceNow / AI Platform
|
Australia W32 <Patch 2 Hot Fix 4b W32 | ||
|
ServiceNow AI Platform Zurich <Patch 11 Hot Fix 3
ServiceNow / AI Platform
|
Zurich <Patch 11 Hot Fix 3 | ||
|
ServiceNow AI Platform Zurich W32 <Patch 10 Hot Fix 4a W32
ServiceNow / AI Platform
|
Zurich W32 <Patch 10 Hot Fix 4a W32 | ||
|
ServiceNow AI Platform Zurich <Patch 10 Hot Fix 3b
ServiceNow / AI Platform
|
Zurich <Patch 10 Hot Fix 3b |
Affected products
Known affected
7 products, the same list as for
CVE-2026-13016
Affected products
Known affected
7 products, the same list as for
CVE-2026-13016
Affected products
Known affected
7 products, the same list as for
CVE-2026-13016
Affected products
Known affected
7 products, the same list as for
CVE-2026-13016
References
3 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Die ServiceNow AI Platform ist eine Sammlung von KI-gest\u00fctzten Funktionen, die in die ServiceNow-Plattform integriert sind, um Arbeitsabl\u00e4ufe zu automatisieren und Entscheidungen zu verbessern.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in ServiceNow AI Platform ausnutzen, um unberechtigt auf Instanzdaten zuzugreifen, Daten zu erstellen, zu ver\u00e4ndern oder zu l\u00f6schen, beliebige SQL-Anweisungen gegen die zugrunde liegende Datenbank auszuf\u00fchren und unter bestimmten Umst\u00e4nden seine Berechtigungen zu erweitern.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-3582 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3582.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-3582 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3582"
},
{
"category": "external",
"summary": "ServiceNow Security Advisory vom 2026-09-24",
"url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3159623"
}
],
"source_lang": "en-US",
"title": "ServiceNow AI Platform: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-09-24T22:00:00.000+00:00",
"generator": {
"date": "2026-09-25T11:04:26.618+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-3582",
"initial_release_date": "2026-09-24T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-09-24T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "Yokohama \u003cPatch 13 Hot Fix 5a",
"product": {
"name": "ServiceNow AI Platform Yokohama \u003cPatch 13 Hot Fix 5a",
"product_id": "T060221"
}
},
{
"category": "product_version",
"name": "Yokohama Patch 13 Hot Fix 5a",
"product": {
"name": "ServiceNow AI Platform Yokohama Patch 13 Hot Fix 5a",
"product_id": "T060221-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:servicenow:ai_platform:yokohama__patch_13_hot_fix_5a"
}
}
},
{
"category": "product_version_range",
"name": "Zurich \u003cPatch 10 Hot Fix 3b",
"product": {
"name": "ServiceNow AI Platform Zurich \u003cPatch 10 Hot Fix 3b",
"product_id": "T060222"
}
},
{
"category": "product_version",
"name": "Zurich Patch 10 Hot Fix 3b",
"product": {
"name": "ServiceNow AI Platform Zurich Patch 10 Hot Fix 3b",
"product_id": "T060222-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:servicenow:ai_platform:zurich__patch_10_hot_fix_3b"
}
}
},
{
"category": "product_version_range",
"name": "Zurich W32 \u003cPatch 10 Hot Fix 4a W32",
"product": {
"name": "ServiceNow AI Platform Zurich W32 \u003cPatch 10 Hot Fix 4a W32",
"product_id": "T060223"
}
},
{
"category": "product_version",
"name": "Zurich W32 Patch 10 Hot Fix 4a W32",
"product": {
"name": "ServiceNow AI Platform Zurich W32 Patch 10 Hot Fix 4a W32",
"product_id": "T060223-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:servicenow:ai_platform:zurich_w32__patch_10_hot_fix_4a_w32"
}
}
},
{
"category": "product_version_range",
"name": "Zurich \u003cPatch 11 Hot Fix 3",
"product": {
"name": "ServiceNow AI Platform Zurich \u003cPatch 11 Hot Fix 3",
"product_id": "T060224"
}
},
{
"category": "product_version",
"name": "Zurich Patch 11 Hot Fix 3",
"product": {
"name": "ServiceNow AI Platform Zurich Patch 11 Hot Fix 3",
"product_id": "T060224-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:servicenow:ai_platform:zurich__patch_11_hot_fix_3"
}
}
},
{
"category": "product_version_range",
"name": "Australia W32 \u003cPatch 2 Hot Fix 4b W32",
"product": {
"name": "ServiceNow AI Platform Australia W32 \u003cPatch 2 Hot Fix 4b W32",
"product_id": "T060225"
}
},
{
"category": "product_version",
"name": "Australia W32 Patch 2 Hot Fix 4b W32",
"product": {
"name": "ServiceNow AI Platform Australia W32 Patch 2 Hot Fix 4b W32",
"product_id": "T060225-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:servicenow:ai_platform:australia_w32__patch_2_hot_fix_4b_w32"
}
}
},
{
"category": "product_version_range",
"name": "Australia \u003cPatch 4 Hot Fix 3",
"product": {
"name": "ServiceNow AI Platform Australia \u003cPatch 4 Hot Fix 3",
"product_id": "T060226"
}
},
{
"category": "product_version",
"name": "Australia Patch 4 Hot Fix 3",
"product": {
"name": "ServiceNow AI Platform Australia Patch 4 Hot Fix 3",
"product_id": "T060226-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:servicenow:ai_platform:australia__patch_4_hot_fix_3"
}
}
},
{
"category": "product_version_range",
"name": "Australia \u003cPatch 5",
"product": {
"name": "ServiceNow AI Platform Australia \u003cPatch 5",
"product_id": "T060227"
}
},
{
"category": "product_version",
"name": "Australia Patch 5",
"product": {
"name": "ServiceNow AI Platform Australia Patch 5",
"product_id": "T060227-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:servicenow:ai_platform:australia__patch_5"
}
}
}
],
"category": "product_name",
"name": "AI Platform"
}
],
"category": "vendor",
"name": "ServiceNow"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-13016",
"product_status": {
"known_affected": [
"T060227",
"T060226",
"T060221",
"T060225",
"T060224",
"T060223",
"T060222"
]
},
"release_date": "2026-09-24T22:00:00.000+00:00",
"title": "CVE-2026-13016"
},
{
"cve": "CVE-2026-86857",
"product_status": {
"known_affected": [
"T060227",
"T060226",
"T060221",
"T060225",
"T060224",
"T060223",
"T060222"
]
},
"release_date": "2026-09-24T22:00:00.000+00:00",
"title": "CVE-2026-86857"
},
{
"cve": "CVE-2026-86858",
"product_status": {
"known_affected": [
"T060227",
"T060226",
"T060221",
"T060225",
"T060224",
"T060223",
"T060222"
]
},
"release_date": "2026-09-24T22:00:00.000+00:00",
"title": "CVE-2026-86858"
},
{
"cve": "CVE-2026-86859",
"product_status": {
"known_affected": [
"T060227",
"T060226",
"T060221",
"T060225",
"T060224",
"T060223",
"T060222"
]
},
"release_date": "2026-09-24T22:00:00.000+00:00",
"title": "CVE-2026-86859"
},
{
"cve": "CVE-2026-86860",
"product_status": {
"known_affected": [
"T060227",
"T060226",
"T060221",
"T060225",
"T060224",
"T060223",
"T060222"
]
},
"release_date": "2026-09-24T22:00:00.000+00:00",
"title": "CVE-2026-86860"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…