ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI…

#!/usr/bin/env bash
# check_cve_2026_86860.sh — ServiceNow AI Platform Missing Authorization Check
# CVE-2026-86860 | CWE-862 | noisgate verification script
# Usage: ./check_cve_2026_86860.sh <instance_url>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <servicenow_instance_url>"
  echo "Example: $0 https://mycompany.service-now.com"
  exit 2
fi

INSTANCE_URL="${1%/}"
TIMEOUT=15

echo "[*] Checking CVE-2026-86860 patch status for: $INSTANCE_URL"
echo ""

# Attempt to fetch build info from stats.do (unauthenticated on many instances)
BUILD_INFO=$(curl -sk --max-time "$TIMEOUT" "${INSTANCE_URL}/stats.do" 2>/dev/null || true)

if [ -z "$BUILD_INFO" ]; then
  # Fallback: try xmlstats.do
  BUILD_INFO=$(curl -sk --max-time "$TIMEOUT" "${INSTANCE_URL}/xmlstats.do" 2>/dev/null || true)
fi

if [ -z "$BUILD_INFO" ]; then
  echo "[!] UNKNOWN — Could not retrieve build information from $INSTANCE_URL"
  echo "    stats.do and xmlstats.do may be restricted. Check manually:"
  echo "    System Diagnostics > Stats > Build tag"
  exit 2
fi

# Extract build tag / version info
BUILD_TAG=$(echo "$BUILD_INFO" | grep -iE '(build tag|build_tag|Build name)' | head -1 | sed 's/.*[>:] *//;s/<.*//' | xargs 2>/dev/null || true)

if [ -z "$BUILD_TAG" ]; then
  BUILD_TAG=$(echo "$BUILD_INFO" | grep -ioE '(yokohama|zurich|australia)[^<"]*' | head -1 | xargs 2>/dev/null || true)
fi

if [ -z "$BUILD_TAG" ]; then
  echo "[!] UNKNOWN — Could not parse build tag from instance response."
  echo "    Manually check: System Diagnostics > Stats"
  echo "    Compare against fixed versions:"
  echo "      Yokohama: Patch 13 Hot Fix 5a+"
  echo "      Zurich:   Patch 10 HF 3b+ / Patch 11 HF 3+"
  echo "      Australia: Patch 2 HF 4b W32+ / Patch 4 HF 3+ / Patch 5+"
  exit 2
fi

echo "[*] Detected build tag: $BUILD_TAG"
echo ""

# Normalize to lowercase for matching
BT_LOWER=$(echo "$BUILD_TAG" | tr '[:upper:]' '[:lower:]')

# Check release family and patch level
check_vulnerable() {
  local bt="$1"

  if echo "$bt" | grep -q 'yokohama'; then
    # Fixed in Patch 13 Hot Fix 5a
    local patch_num=$(echo "$bt" | grep -oE 'patch[_ ]?([0-9]+)' | grep -oE '[0-9]+' | head -1)
    if [ -z "$patch_num" ]; then return 2; fi
    if [ "$patch_num" -lt 13 ]; then return 1; fi
    if [ "$patch_num" -gt 13 ]; then return 0; fi
    # Patch 13 — check hot fix
    if echo "$bt" | grep -qiE 'hot[_ ]?fix[_ ]?([5-9]|[1-9][0-9])'; then return 0; fi
    return 1

  elif echo "$bt" | grep -q 'zurich'; then
    local patch_num=$(echo "$bt" | grep -oE 'patch[_ ]?([0-9]+)' | grep -oE '[0-9]+' | head -1)
    if [ -z "$patch_num" ]; then return 2; fi
    if [ "$patch_num" -gt 11 ]; then return 0; fi
    if [ "$patch_num" -lt 10 ]; then return 1; fi
    if [ "$patch_num" -eq 11 ]; then
      if echo "$bt" | grep -qiE 'hot[_ ]?fix[_ ]?([3-9]|[1-9][0-9])'; then return 0; fi
      return 1
    fi
    # Patch 10 — need HF 3b+ or HF 4a+
    if echo "$bt" | grep -qiE 'hot[_ ]?fix[_ ]?([4-9]|[1-9][0-9])'; then return 0; fi
    if echo "$bt" | grep -qiE 'hot[_ ]?fix[_ ]?3[b-z]'; then return 0; fi
    return 1

  elif echo "$bt" | grep -q 'australia'; then
    local patch_num=$(echo "$bt" | grep -oE 'patch[_ ]?([0-9]+)' | grep -oE '[0-9]+' | head -1)
    if [ -z "$patch_num" ]; then return 2; fi
    if [ "$patch_num" -ge 5 ]; then return 0; fi
    if [ "$patch_num" -eq 4 ]; then
      if echo "$bt" | grep -qiE 'hot[_ ]?fix[_ ]?([3-9]|[1-9][0-9])'; then return 0; fi
      return 1
    fi
    if [ "$patch_num" -le 1 ]; then return 1; fi
    if [ "$patch_num" -eq 2 ]; then
      if echo "$bt" | grep -qiE 'hot[_ ]?fix[_ ]?4[b-z]'; then return 0; fi
      if echo "$bt" | grep -qiE 'hot[_ ]?fix[_ ]?([5-9]|[1-9][0-9])'; then return 0; fi
      return 1
    fi
    if [ "$patch_num" -eq 3 ]; then return 1; fi
    return 2
  fi

  return 2
}

check_vulnerable "$BT_LOWER"
RESULT=$?

echo "======================================"
if [ $RESULT -eq 0 ]; then
  echo "PATCHED — Build tag indicates a fixed version."
  echo "CVE-2026-86860 is remediated on this instance."
  exit 0
elif [ $RESULT -eq 1 ]; then
  echo "VULNERABLE — Build tag indicates an unpatched version."
  echo "CVE-2026-86860 affects this instance. Apply the appropriate hot fix:"
  echo "  Yokohama: Patch 13 Hot Fix 5a"
  echo "  Zurich:   Patch 10 HF 3b / HF 4a W32, or Patch 11 HF 3"
  echo "  Australia: Patch 2 HF 4b W32, Patch 4 HF 3, or Patch 5"
  exit 1
else
  echo "UNKNOWN — Could not determine patch status from build tag."
  echo "Manually verify against fixed versions listed above."
  exit 2
fi