ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform.

#!/usr/bin/env bash
# CVE-2026-13016 Checker — ServiceNow AI Platform SQL Injection
# Determines whether a ServiceNow instance is on a vulnerable release train.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -uo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 https://your-instance.service-now.com"
  exit 2
fi

INSTANCE="${1%/}"
echo "[*] Target: ${INSTANCE}"
echo "[*] Fetching build info from stats.do ..."

RESPONSE=$(curl -skL --max-time 20 "${INSTANCE}/stats.do" 2>/dev/null)

if [ -z "$RESPONSE" ]; then
  echo "[!] ERROR: Could not reach ${INSTANCE}/stats.do"
  echo "UNKNOWN"
  exit 2
fi

# Extract build name (e.g., "glide-australia-02-04-2026__patch5-hotfix0-09-18-2026")
BUILD=$(echo "$RESPONSE" | grep -ioP '(?:Build name|Build tag)[:\s]*\K[^\s<"]+' | head -1)

if [ -z "$BUILD" ]; then
  echo "[!] stats.do reachable but build info not parseable."
  echo "[!] Likely locked via glide.security.diag_txns_acl."
  echo "[*] Check manually: System Diagnostics > Stats > Build name."
  echo "UNKNOWN"
  exit 2
fi

BUILD_LOWER=$(echo "$BUILD" | tr '[:upper:]' '[:lower:]')
echo "[*] Build: ${BUILD}"

# Determine release train
TRAIN="unknown"
if echo "$BUILD_LOWER" | grep -q 'yokohama'; then TRAIN="yokohama"
elif echo "$BUILD_LOWER" | grep -q 'zurich'; then TRAIN="zurich"
elif echo "$BUILD_LOWER" | grep -q 'australia'; then TRAIN="australia"
fi

if [ "$TRAIN" = "unknown" ]; then
  echo "[*] Release train not in affected set (Yokohama/Zurich/Australia)."
  echo "[*] If running a newer release, likely not affected."
  echo "[*] If running an older EOL release, check separately."
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Release train: ${TRAIN}"
echo ""
echo "=== Patched versions for ${TRAIN} ==="
case "$TRAIN" in
  yokohama)
    echo "  Yokohama Patch 13 Hot Fix 5a or later"
    ;;
  zurich)
    echo "  Zurich Patch 10 Hot Fix 3b or later"
    echo "  Zurich Patch 10 Hot Fix 4a W32 or later"
    echo "  Zurich Patch 11 Hot Fix 3 or later"
    ;;
  australia)
    echo "  Australia Patch 2 Hot Fix 4b W32 or later"
    echo "  Australia Patch 4 Hot Fix 3 or later"
    echo "  Australia Patch 5 or later"
    ;;
esac
echo ""
echo "[!] Instance is on affected release train: ${TRAIN}"
echo "[!] Verify your exact patch+hotfix level against the list above."
echo "[!] If your build predates the fix, this instance is:"
echo "VULNERABLE"
exit 1