ServiceNow AI Platform Multiple Vulnerabilities (September 2026 CVE Advisory)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(362649);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/02");

  script_cve_id(
    "CVE-2026-13016",
    "CVE-2026-86857",
    "CVE-2026-86858",
    "CVE-2026-86859",
    "CVE-2026-86860"
  );
  script_xref(name:"IAVA", value:"2026-A-1077");

  script_name(english:"ServiceNow AI Platform Multiple Vulnerabilities (September 2026 CVE Advisory)");

  script_set_attribute(attribute:"synopsis", value:
"ServiceNow AI Platform is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the ServiceNow AI Platform (Now Platform) running on the remote host is missing the remediations
described in the September 2026 CVE Advisory Notification. It is, therefore, affected by multiple vulnerabilities,
including the following:

  - A SQL injection vulnerability that could enable an unauthenticated user, in certain circumstances, to execute
    arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance
    data beyond what was intended. (CVE-2026-13016)

  - A missing authorization vulnerability that could enable an unauthenticated user, in certain circumstances, to
    extract instance data beyond what was intended, resulting in privilege escalation. (CVE-2026-86860)

  - An authorization bypass security issue that, if exploited, could enable an unauthenticated user to access data
    that the user otherwise would not be entitled to access, potentially enabling further unintended access.
    (CVE-2026-86859)

See the vendor advisory for the remaining issues (CVE-2026-86857, CVE-2026-86858).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3159623
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8a036ad2");
  script_set_attribute(attribute:"solution", value:
"Upgrade ServiceNow AI Platform to Yokohama Patch 13 Hot Fix 5a, Zurich Patch 10 Hot Fix 3b (or any later Patch 10
Hot Fix such as 4a), Zurich Patch 11 Hot Fix 3, Australia Patch 2 Hot Fix 4b, Australia Patch 4 Hot Fix 3,
Australia Patch 5, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13016");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/24");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/02");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:servicenow:servicenow");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_cwe_id(89);
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("servicenow_platform_web_detect.nbin");
  script_require_keys("installed_sw/ServiceNow Platform");
  script_require_ports("Services/www", 443);

  exit(0);
}

include('webapp_func.inc');
include('vcf.inc');

##
# Determines whether the detected release / patch / hot fix combination is missing the
# September 2026 CVE Advisory remediations. Only the builds the advisory documents as
# remediated are treated as fixed. An install reporting no hot fix predates every hot
# fix of its patch level.
#
# @param release Named ServiceNow AI Platform release (e.g. 'Zurich')
# @param patch   Parsed patch level as reported by the detection (e.g. '10', '4a')
# @param hotfix  Parsed hot fix level, or NULL when the detection reports none
#
# @return the fix string when vulnerable, NULL otherwise
##
function is_vuln(release, patch, hotfix)
{
  if ('Yokohama' >< release)
  {
    # Remediated: Patch 13 Hot Fix 5a
    if (vcf::compare_version_to_check(version:patch, comparator:'<', cmp_ver:'13'))
      return 'Yokohama Patch 13 Hot Fix 5a';
    if (vcf::compare_version_to_check(version:patch, comparator:'=', cmp_ver:'13') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'5a')))
      return 'Yokohama Patch 13 Hot Fix 5a';
  }
  else if ('Zurich' >< release)
  {
    # Remediated: Patch 10 Hot Fix 3b, Patch 10 Hot Fix 4a, Patch 11 Hot Fix 3
    if (vcf::compare_version_to_check(version:patch, comparator:'<', cmp_ver:'10'))
      return 'Zurich Patch 10 Hot Fix 3b';
    if (vcf::compare_version_to_check(version:patch, comparator:'=', cmp_ver:'10') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'3b')))
      return 'Zurich Patch 10 Hot Fix 3b';
    if (vcf::compare_version_to_check(version:patch, comparator:'=', cmp_ver:'11') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'3')))
      return 'Zurich Patch 11 Hot Fix 3';
  }
  else if ('Australia' >< release)
  {
    # Remediated: Patch 2 Hot Fix 4b, Patch 4 Hot Fix 3, Patch 5
    if (vcf::compare_version_to_check(version:patch, comparator:'<', cmp_ver:'2'))
      return 'Australia Patch 2 Hot Fix 4b';
    if (vcf::compare_version_to_check(version:patch, comparator:'=', cmp_ver:'2') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'4b')))
      return 'Australia Patch 2 Hot Fix 4b';
    # The advisory documents no remediated Patch 3 build; Patch 4 Hot Fix 3 is the next one.
    if (vcf::compare_version_to_check(version:patch, comparator:'=', cmp_ver:'3'))
      return 'Australia Patch 4 Hot Fix 3';
    if (vcf::compare_version_to_check(version:patch, comparator:'=', cmp_ver:'4') &&
        (isnull(hotfix) || vcf::compare_version_to_check(version:hotfix, comparator:'<', cmp_ver:'3')))
      return 'Australia Patch 4 Hot Fix 3';
  }

  return NULL;
}

var app = 'ServiceNow Platform';

# Exit if app is not detected on host
get_install_count(app_name:app, exit_if_zero:TRUE);

# Exit if app is not detected on this http port
var port = get_http_port(default:443);
var install = get_single_install(
  app_name : app,
  port     : port
);

var release = install['Release'];
if (empty_or_null(release)) audit(AUDIT_UNKNOWN_APP_VER, app);

if (empty_or_null(install['Patch'])) audit(AUDIT_UNKNOWN_APP_VER, app);

# Purely numeric patch / hot fix levels come back from the KB as ints, so cast before parsing.
var patch = vcf::parse_version(string(install['Patch']));
if (vcf::is_error(patch)) audit(AUDIT_UNKNOWN_APP_VER, app);

var hotfix_str = install['Hotfix'];

# The detection's hot fix regex needs two or more characters, so a single-character
# level such as 'Hot Fix 3' is never stored in Hotfix. Read it from the build stamp instead.
if (empty_or_null(hotfix_str) && !empty_or_null(install['Build Stamp']))
{
  var hf_match = pregmatch(string:install['Build Stamp'], pattern:'-hotfix([0-9][0-9a-z]*)-', icase:TRUE);
  if (!isnull(hf_match)) hotfix_str = hf_match[1];
}

var hotfix = NULL;
if (!empty_or_null(hotfix_str))
{
  hotfix = vcf::parse_version(string(hotfix_str));
  if (vcf::is_error(hotfix)) hotfix = NULL;
}

var fix_version = is_vuln(release:release, patch:patch, hotfix:hotfix);
if (!empty_or_null(fix_version))
  vcf::report_results(app_info:install, fix:fix_version, severity:SECURITY_HOLE, flags:{"sqli":TRUE});
else
  audit(AUDIT_INST_VER_NOT_VULN, app);