CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

ServiceNow AI Platform sandbox escape, unauthenticated code execution within the platform (CVSS 9.5); hosted fixed server-side, self-hosted/partner patch listed family releases

cve · CVE-2026-6875

Coverage
1
first 2026-07-13 → last 2026-09-30
Latest activity
2026-07-21
ServiceNow patches an unauthenticated code-execution sandbox escape in its AI Platform; self-hosted and…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, technology, finance
Sources cited
5
5 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-6875, newest first. Check the date before acting on an older one.

  • Apply the fixed release for your family listed in ServiceNow security bulletin KB3137947 (Zurich Patch 7b or 9, Yokohama Patch 12 Hot Fix 1b or Patch 13, Australia Patch 2, Brazil EA or GA) to every self-hosted or partner-managed ServiceNow AI Platform instance now. Exploitation attempts have been reported since 2026-07-17, and self-hosted instances are the ones ServiceNow did not fix itself.
    2026-07-13CVE-2026-6875

Defender insights

What each entry about CVE-2026-6875 tells a defender to do, newest first.

2026-07-13HIGHexploitedServiceNow patches an unauthenticated code-execution sandbox escape in its AI Platform; self-hosted and partner-managed instances are the residual exposure

Story timeline

  1. 2026-07-13CVE-2026-6875, ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)
    trending-vulnerabilitiesServiceNow patches an unauthenticated code-execution sandbox escape in its AI Platform; self-hosted and partner-managed instances are the residual exposure

Hunting pivots

Affected products
ServiceNow AI Platform
Tags
actively-exploitedai-abuseauth-bypasspatch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: JavaScript

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-13/servicenow-ai-platform-sandbox-escape-cve-2026-6875 · ATT&CK page ↗

Execution TA0002

T1059.007Command and Scripting Interpreter: JavaScript×1

Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Evidence: 2026-07-13/servicenow-ai-platform-sandbox-escape-cve-2026-6875 · ATT&CK page ↗

Entries about ServiceNow AI Platform sandbox escape, unauthenticated code execution within the platform (CVSS 9.5); hosted fixed server-side, self-hosted/partner patch listed family releases (1)

2026-07-13 · view entry permalink →

HIGHCVE-2026-6875exploitedupdatedNATOA2

CVE-2026-6875, ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)

ServiceNow disclosed CVE-2026-6875, a "Sandbox Escape in ServiceNow AI Platform" rated CVSS 4.0 9.5, in security bulletin KB3137947 published 2026-07-13 (ServiceNow, 2026-07-13; ENISA EUVD, 2026-07-13). Per ServiceNow, the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform", an isolation failure in the AI Platform's code-execution environment. ServiceNow states it "addressed this vulnerability by deploying a security update to hosted instances," and provided updates to self-hosted customers and partners (ServiceNow, 2026-07-13). Fixed releases are Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2 and Brazil EA/GA (ServiceNow, 2026-07-13).

Contradiction: ServiceNow's advisory states that it is "not currently aware of exploitation against ServiceNow instances" (ServiceNow, 2026-07-13). BleepingComputer reported on 2026-07-20 that the advisory still said so and that ServiceNow had yet to flag the flaw as actively abused, and a ServiceNow spokesperson told it that, based on its investigation to date, it had not observed evidence that the activity is related to instances ServiceNow hosts (BleepingComputer, 2026-07-20). Defused reports in-the-wild exploitation attempts since 2026-07-17 (BleepingComputer, 2026-07-20), and NCSC-CH gives the exploitation status as actively exploited, citing that reporting (NCSC-CH, 2026-07-20).

This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.

We are not currently aware of exploitation against ServiceNow instances.

ServiceNow

Current exploitation status: Actively exploited

NCSC-CH Cyber Security Hub 2026-07-20
Updaterun 2026-07-21T0409Z-intelactionscvesevidenceprioritysectorssourcestagsbody

The unauthenticated ServiceNow AI Platform sandbox escape has moved from "no known exploitation" to reported active exploitation. NCSC-CH's advisory of 2026-07-20 gives the exploitation status as "Actively exploited" and cites news coverage of claims of active exploitation (NCSC-CH, 2026-07-20), and BleepingComputer reports attackers "begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform," attributing the in-the-wild observation to threat-intelligence firm Defused, which saw first attempts on 2026-07-17 (BleepingComputer, 2026-07-20). Searchlight Cyber's analysis shows the mechanism: an unauthenticated caller gets server-side JavaScript evaluated through a GlideRecord query on a pre-authentication page, then escapes the script sandbox by obtaining the Function constructor through Class.create.constructor and running it during a gs.include() script-include evaluation, which ServiceNow runs without the sandbox's constraints (Searchlight Cyber, 2026-07-14).

The operational change is entirely one of urgency: exploitation is live, so any self-hosted or partner-managed AI Platform instance still missing the fixed release has crossed from "patch on the normal cycle" to "patch out of band." ServiceNow's hosted/SaaS estate is already remediated, so exposure concentrates in on-prem and MSP-run deployments, which should be inventoried first. The hunt telemetry is in the takeaway above.

Correctionrun 2026-09-30T0639Z-auditsummarysourcing_noteverificationbodytechniquesactionscves

The summary above said no exploitation was known. BleepingComputer reports Defused observing first exploitation attempts on 2026-07-17, and NCSC-CH's advisory of 2026-07-20 flags the CVE as actively exploited, citing that news coverage (NCSC-CH, 2026-07-20; BleepingComputer, 2026-07-20). ServiceNow's advisory states that it is not currently aware of exploitation against ServiceNow instances (ServiceNow, 2026-07-13), and its spokesperson told BleepingComputer that it had not observed evidence that the activity relates to instances ServiceNow hosts (BleepingComputer, 2026-07-20).

The takeaway above also said no exploitation discriminator existed. The observed payloads hit the pre-authentication sink /assessment_thanks.do that Searchlight Cyber documented, by a different route than its published proof of concept (BleepingComputer, 2026-07-20). Searchlight's own route abuses javascript: values in GlideRecord query parameters and gs.include() evaluation (Searchlight Cyber, 2026-07-14). The sandboxed script cannot call eval or new Function, which the sandbox forbids. It reaches the Function constructor indirectly, through Class.create.constructor, and a gs.include() evaluation outside the sandbox then runs it (Searchlight Cyber, 2026-07-14). Its example request is a GET, not a POST.

ServiceNow addressed hosted instances starting in April. 2026-07-13 is the release date of the self-hosted updates, and KB3137947 is the security bulletin listing the fixed releases, not a hotfix (BleepingComputer, 2026-07-20; ServiceNow, 2026-07-13).

vulnerability13 Jul 20:34Zmulti-sourceOpen finding →
Sources: ServiceNow (vendor security KB / PSIRT) · ENISA EU Vulnerability Database · NCSC-CH Cyber Security Hub · BleepingComputer · Searchlight Cyber

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (20%)
  • euvd.enisa.europa.eu1 (20%)
  • security-hub.ncsc.admin.ch1 (20%)
  • slcyber.io1 (20%)
  • support.servicenow.com1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)