2026-07-13 · view entry permalink →
CVE-2026-6875 — ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)
ServiceNow disclosed CVE-2026-6875, a "Sandbox Escape in ServiceNow AI Platform" rated CVSS 4.0 9.5, in security bulletin KB3137947 published 2026-07-13 (ServiceNow, 2026-07-13; ENISA EUVD, 2026-07-13). Per ServiceNow, the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform" — an isolation failure in the AI Platform's code-execution environment. ServiceNow states it "addressed this vulnerability by deploying a security update to hosted instances," provided updates to self-hosted customers and partners, and is "not currently aware of exploitation against ServiceNow instances" (ServiceNow, 2026-07-13). Fixed releases are Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2 and Brazil EA/GA. Because hosted instances were remediated server-side by the vendor, the live exposure is narrowed to self-hosted and partner-managed deployments that have not yet applied the update — a population that still includes public-sector and critical-infrastructure operators running ServiceNow ITSM, HR-service-delivery and case-management on-prem or through partners.
This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.
We are not currently aware of exploitation against ServiceNow instances.
Current exploitation status: Actively exploited
The unauthenticated ServiceNow AI Platform sandbox escape has moved from "no known exploitation" to confirmed active exploitation. NCSC-CH's 2026-07-20 advisory revision set the item's status to "Actively exploited" (NCSC-CH, 2026-07-20), and BleepingComputer reports attackers "begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform," attributing the in-the-wild observation to threat-intelligence firm Defused from around 2026-07-18 (BleepingComputer, 2026-07-20). The mechanism is unchanged from the original entry — an unauthenticated caller reaches unrestricted server-side script execution through the GlideRecord query path, a chain Searchlight Cyber demonstrated where "running any code via eval or new Function will run free from the constraints of the additional sandbox" (Searchlight Cyber, 2026-07-14).
The operational change is entirely one of urgency: exploitation is live, so any self-hosted or partner-managed AI Platform instance still missing the vendor hotfix has crossed from "patch on the normal cycle" to "patch out of band."