CVE-2026-6875, ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)
ServiceNow patches an unauthenticated code-execution sandbox escape in its AI Platform; self-hosted and partner-managed instances are the residual exposure
Defender actions
- Apply the fixed release for your family listed in ServiceNow security bulletin KB3137947 (Zurich Patch 7b or 9, Yokohama Patch 12 Hot Fix 1b or Patch 13, Australia Patch 2, Brazil EA or GA) to every self-hosted or partner-managed ServiceNow AI Platform instance now. Exploitation attempts have been reported since 2026-07-17, and self-hosted instances are the ones ServiceNow did not fix itself.
Analysis
ServiceNow disclosed CVE-2026-6875, a "Sandbox Escape in ServiceNow AI Platform" rated CVSS 4.0 9.5, in security bulletin KB3137947 published 2026-07-13 (ServiceNow, 2026-07-13; ENISA EUVD, 2026-07-13). Per ServiceNow, the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform", an isolation failure in the AI Platform's code-execution environment. ServiceNow states it "addressed this vulnerability by deploying a security update to hosted instances," and provided updates to self-hosted customers and partners (ServiceNow, 2026-07-13). Fixed releases are Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2 and Brazil EA/GA (ServiceNow, 2026-07-13).
Contradiction: ServiceNow's advisory states that it is "not currently aware of exploitation against ServiceNow instances" (ServiceNow, 2026-07-13). BleepingComputer reported on 2026-07-20 that the advisory still said so and that ServiceNow had yet to flag the flaw as actively abused, and a ServiceNow spokesperson told it that, based on its investigation to date, it had not observed evidence that the activity is related to instances ServiceNow hosts (BleepingComputer, 2026-07-20). Defused reports in-the-wild exploitation attempts since 2026-07-17 (BleepingComputer, 2026-07-20), and NCSC-CH gives the exploitation status as actively exploited, citing that reporting (NCSC-CH, 2026-07-20).
Cited evidence
This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.
We are not currently aware of exploitation against ServiceNow instances.
Current exploitation status: Actively exploited
Updates2
The unauthenticated ServiceNow AI Platform sandbox escape has moved from "no known exploitation" to reported active exploitation. NCSC-CH's advisory of 2026-07-20 gives the exploitation status as "Actively exploited" and cites news coverage of claims of active exploitation (NCSC-CH, 2026-07-20), and BleepingComputer reports attackers "begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform," attributing the in-the-wild observation to threat-intelligence firm Defused, which saw first attempts on 2026-07-17 (BleepingComputer, 2026-07-20). Searchlight Cyber's analysis shows the mechanism: an unauthenticated caller gets server-side JavaScript evaluated through a GlideRecord query on a pre-authentication page, then escapes the script sandbox by obtaining the Function constructor through Class.create.constructor and running it during a gs.include() script-include evaluation, which ServiceNow runs without the sandbox's constraints (Searchlight Cyber, 2026-07-14).
The operational change is entirely one of urgency: exploitation is live, so any self-hosted or partner-managed AI Platform instance still missing the fixed release has crossed from "patch on the normal cycle" to "patch out of band." ServiceNow's hosted/SaaS estate is already remediated, so exposure concentrates in on-prem and MSP-run deployments, which should be inventoried first. The hunt telemetry is in the takeaway above.
The summary above said no exploitation was known. BleepingComputer reports Defused observing first exploitation attempts on 2026-07-17, and NCSC-CH's advisory of 2026-07-20 flags the CVE as actively exploited, citing that news coverage (NCSC-CH, 2026-07-20; BleepingComputer, 2026-07-20). ServiceNow's advisory states that it is not currently aware of exploitation against ServiceNow instances (ServiceNow, 2026-07-13), and its spokesperson told BleepingComputer that it had not observed evidence that the activity relates to instances ServiceNow hosts (BleepingComputer, 2026-07-20).
The takeaway above also said no exploitation discriminator existed. The observed payloads hit the pre-authentication sink /assessment_thanks.do that Searchlight Cyber documented, by a different route than its published proof of concept (BleepingComputer, 2026-07-20). Searchlight's own route abuses javascript: values in GlideRecord query parameters and gs.include() evaluation (Searchlight Cyber, 2026-07-14). The sandboxed script cannot call eval or new Function, which the sandbox forbids. It reaches the Function constructor indirectly, through Class.create.constructor, and a gs.include() evaluation outside the sandbox then runs it (Searchlight Cyber, 2026-07-14). Its example request is a GET, not a POST.
ServiceNow addressed hosted instances starting in April. 2026-07-13 is the release date of the self-hosted updates, and KB3137947 is the security bulletin listing the fixed releases, not a hotfix (BleepingComputer, 2026-07-20; ServiceNow, 2026-07-13).
Sources5
Revision history
- Published 2026-07-13T2009Z-intel
- Update 2026-07-21T0409Z-intel
NCSC-CH updated its advisory on 2026-07-20 to flag CVE-2026-6875 (the pre-authentication sandbox escape in the ServiceNow AI Platform first covered here on 2026-07-13) as actively exploited, with in-the-wild activity reported from 2026-07-18. ServiceNow's own hosted instances were already patched; self-hosted and partner-managed deployments that have not applied hotfix KB3137947 are the residual exposure, and this is now an out-of-band-priority item rather than a scheduled patch.
Changed: actions cves evidence priority sectors sources tags body
- Correction 2026-09-30T0639Z-audit
The summary still said no exploitation was known after the 2026-07-21 update recorded NCSC-CH's active-exploitation flag, and the takeaway said no hunt discriminator existed, misdated the hosted fix and called security bulletin KB3137947 a hotfix. The takeaway now leads with the /assessment_thanks.do sink the observed payloads hit, marks the gs.include() route as Searchlight Cyber's proof of concept, and notes the Guarded Script changes that ship with the patches. ServiceNow's statement that it is not aware of exploitation is set against the exploitation reports. The 2026-07-21 section no longer calls NCSC-CH's first advisory a revision or the exploitation confirmed, dates Defused's first attempts to 2026-07-17, and describes Searchlight's sandbox escape through gs.include() rather than eval. An uncited exposure clause is removed.
Changed: summary sourcing_note verification body techniques actions cves
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.