ServiceNow AI Platform CVE-2026-13016

Exploitation targets the ServiceNow AI Platform and requires no authentication (PR:N) and no user interaction (UI:N), reachable over the network against the instance. The critical limiting factor is the vendor's explicit 'in certain circumstances' qualifier, indicating the injectable path is not universally reachable and likely depends on a specific feature, module, or request flow being present/enabled - meaning realistic attack complexity is higher than the AC:L rating suggests. The most significant real-world limiter is that ServiceNow already applied the fix to hosted instances, so unpatched exposure is confined to self-hosted and partner-managed deployments that have not yet upgraded to the patched release referenced in KB3159623.

This is a genuine high-priority issue, not an inflated CVSS artifact. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/VA:H) describes an unauthenticated, network-reachable SQL injection affecting the confidentiality, integrity, and availability of instance data - the most dangerous combination for a SaaS platform holding enterprise workflow and ITSM records. However, the description's qualifier 'in certain circumstances' conflicts with the AC:L rating: if exploitation depends on a specific feature, module, or data path being present, the real-world complexity is closer to AC:H, and defenders should treat the raw 9.3 as an upper bound. Mitigating the urgency: ServiceNow states it is NOT aware of malicious exploitation, there is no CISA KEV listing, no EPSS score, and no public PoC - so exploitation is theoretical at time of analysis rather than observed. Also important, ServiceNow already deployed the fix to hosted instances automatically, so the residual exposure is concentrated in self-hosted and partner-managed deployments that have not yet applied the update. Net: high intrinsic severity, currently no evidence of active exploitation, and hosted customers are largely already protected.

A remote attacker with no credentials sends crafted input to an exposed ServiceNow AI Platform request path that reaches an unsanitized SQL query, injecting arbitrary SQL against the instance's underlying database. This allows them to read confidential instance data (tickets, user records, configuration) or modify/delete it beyond their intended authorization. No public exploit code has been identified, and vendor states no known exploitation, so this remains a theoretical chain gated by the unspecified 'certain circumstances' condition.