ServiceNow AI Platform CVE-2026-86859

Exploitation requires network reachability to a ServiceNow AI Platform instance and no authentication (PR:N), user interaction (UI:N), or special attack requirements (AT:N) per the vendor vector - an unauthenticated user can access data on a running instance. The primary limiting factor is patch status: ServiceNow has already updated hosted instances, so exposure is concentrated on self-hosted and partner-managed deployments that have not yet applied the KB3159623 update or upgraded to a patched release. Impact is confined to unauthorized data reads (confidentiality only); the description does not indicate data modification or service disruption. The exact preconditions ('in certain circumstances'-style qualifiers) are not detailed in the public description, so the precise trigger conditions are known only to the vendor.

This is a genuine priority for ServiceNow customers despite the absence of exploitation telemetry. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) describes a fully network-reachable, unauthenticated, low-complexity authorization bypass with high confidentiality impact - the worst-case exposure profile short of code execution. The 8.7 base score is driven entirely by data confidentiality (VC:H) with no integrity or availability impact (VI:N/VA:N), which is consistent with the description of an authorization bypass that lets an attacker read data they are not entitled to. Countervailing signals: there is no EPSS score, no CISA KEV listing, and no public POC, and ServiceNow explicitly states it is not currently aware of malicious exploitation - so this is elevated-but-not-confirmed-active risk. No SSVC decision framework data was provided in the input. The CVSS PR:N (unauthenticated) claim is internally consistent with the description's 'unauthenticated user' language, so attack-vector and description agree. CWE is listed as N/A in the input, but the description ('authorization bypass ... access data ... otherwise would not be entitled') maps cleanly to CWE-639/CWE-863 (broken/improper authorization), which is worth noting since the 'Authentication Bypass' tag is a loose fit - the flaw is an authorization failure, not an authentication one.

An unauthenticated remote attacker sends crafted requests to an internet-reachable ServiceNow AI Platform instance and, by exploiting the missing authorization check, retrieves records and data belonging to other tenants or privileged scopes that should be inaccessible. The description notes this could enable 'further unintended access,' so harvested data (identifiers, tokens, or configuration) may be pivoted into deeper access. No public exploit code is identified at time of analysis, and the vendor reports no known in-the-wild exploitation.