CVE-2026-6875: ServiceNow AI Platform Sandbox Escape Under Active Exploitation

Summary

• what: Threat actors are actively exploiting CVE-2026-6875, a critical (CVSS 9.5) sandbox escape in the ServiceNow AI Platform that allows unauthenticated arbitrary code execution via a pre-auth endpoint.
• impact: Successful exploitation yields complete compromise of the ServiceNow instance and all connected proxy servers, exposing ITSM data, credentials, and integrations across the environment.
• fix: Apply the June 2026 ServiceNow patches now: Brazil EA/GA, Australia Patch 2, Zurich Patch 7b or 9, or Yokohama Patch 12 Hot Fix 1b or Patch 13.
• who: Every organization running a self-hosted ServiceNow instance on an unpatched release is exposed to an unauthenticated, PoC-armed attack; ServiceNow-hosted customers should confirm patch status regardless.

Attackers are exploiting a critical sandbox escape in the ServiceNow AI Platform that hands them unauthenticated code execution on the instance. CVE-2026-6875 carries a CVSS score of 9.5, requires no credentials, and according to disclosure firm Searchlight Cyber leads to complete compromise of the ServiceNow instance and every proxy server connected to it. Threat intelligence firm Defused Cyber reported in-the-wild exploitation on July 21, 2026, with captured payloads matching Searchlight's public proof-of-concept. Patches have been available since June. If you run a self-hosted instance and have not applied them, treat this as an incident-prevention task for today, not a change-window item.

What the Vulnerability Is

CVE-2026-6875 is a sandbox escape in the ServiceNow AI Platform. ServiceNow, like most low-code and AI-enabled platforms, executes user- and workflow-supplied code inside a restricted sandbox to prevent that code from reaching the underlying host or instance internals. This flaw breaks out of that boundary. Once the sandbox constraint is gone, an attacker's input is no longer sandboxed script; it is arbitrary code running with the platform's own privileges.

The critical multiplier here is that the exploit is reachable pre-authentication. Defused Cyber observed exploitation against the endpoint /assessment_thanks.do using HTTP POST requests. That endpoint is exposed without a valid session, which means an attacker does not need stolen credentials, a phishing foothold, or an insider. Internet-facing exposure plus an unpatched build is the entire prerequisite.

⚠️ Pre-auth RCE means no login step to detect - Because CVE-2026-6875 is exploitable before authentication, there is no failed-login pattern, credential-stuffing spike, or MFA prompt to alert on. The first observable signal may be the code execution itself. Hunt on POST requests to /assessment_thanks.do and unexpected child processes or outbound connections from the ServiceNow application tier.

Why the Blast Radius Is Large

A ServiceNow instance is rarely an island. It typically holds IT service management data, asset and configuration records, workflow automation, and stored credentials for the systems it integrates with. Searchlight Cyber's disclosure states the flaw allows complete compromise of the instance as well as all connected proxy servers. That turns a single vulnerable platform into a pivot point into the rest of the environment.

• Full instance compromise: read/write access to ITSM tickets, CMDB records, and any secrets stored in the instance.
• Connected proxy servers: lateral reach into the network segments those proxies bridge.
• Integration credentials: ServiceNow commonly stores API keys and service accounts for downstream systems, extending the attacker's reach beyond the platform itself.
• Automation abuse: workflow and orchestration capabilities can be repurposed to execute actions across the estate under a trusted identity.

Timeline and Disclosure

Searchlight Cyber reported the issue to ServiceNow on April 1, 2026. ServiceNow rolled out fixes throughout June across its supported release trains. Defused Cyber flagged active exploitation on July 21, roughly 111 days after the initial report and within weeks of patches becoming available. That compression, from vendor fix to in-the-wild exploitation, is the recurring pattern for high-severity enterprise flaws with a public PoC: the disclosure that helps defenders patch also arms attackers who reverse the fix.

Defused's reporting included one correction worth noting for accuracy. The firm initially suggested the observed payload reached the same code-execution primitive by a different route than the published PoC, then corrected itself to confirm the captured payload matches Searchlight Cyber's PoC. In practical terms, attackers are firing the public exploit, not a bespoke variant.

The Vendor Position

After publication, a ServiceNow spokesperson told The Hacker News the company has not observed evidence of exploitation to date, and specifically that it has seen no activity related to instances ServiceNow itself hosts. ServiceNow reiterated that patches are available and urged both self-hosted and ServiceNow-hosted customers to apply them, offering direct assistance to customers who need help.

Note the scope of the statement: it addresses ServiceNow-hosted infrastructure. Self-hosted instances sit outside the vendor's telemetry, and Defused's exploitation reporting was not limited to hosted environments. Absence of evidence on the vendor's own fleet is not evidence of absence across every self-managed deployment.

Patch Matrix

Apply the fixed build for your release family:

• Brazil EA and Brazil GA
• Australia Patch 2
• Zurich Patch 7b or Zurich Patch 9
• Yokohama Patch 12 Hot Fix 1b or Yokohama Patch 13

ServiceNow is also hardening the platform by severely restricting the type of code permitted to run in sandbox contexts, per researcher Adam Kues.

What to Do Now

• Patch immediately: move any self-hosted instance to a fixed build (Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, or Yokohama Patch 12 Hot Fix 1b/Patch 13). This is the primary mitigation.
• Hunt retroactively: review web and application logs for HTTP POST requests to /assessment_thanks.do, and check for unexpected processes, outbound connections, or new accounts on the ServiceNow application tier.
• Assume the sandbox held nothing back: if you find evidence of exploitation, treat connected proxy servers and any credentials stored in the instance as compromised and rotate them.
• Reduce exposure: restrict internet-facing access to the platform where business requirements allow, and put a WAF rule in front of the affected pre-auth endpoint as a stopgap, not a substitute for patching.
• Confirm hosted status: even if you are ServiceNow-hosted, verify your instance is on a patched build rather than relying on the vendor's fleet-wide statement.

The through-line is simple. This is a CVSS 9.5, unauthenticated, PoC-armed remote code execution flaw in a platform that typically sits at the center of IT operations and holds the credentials to reach everything else. Patches exist. The gap between having a fix and applying it is the entire attack surface here, and attackers are already inside that gap.

Originally published on RedEye Threat Intelligence.