CVE-2026-6875 — ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5)
ServiceNow disclosed CVE-2026-6875, a "Sandbox Escape in ServiceNow AI Platform" rated CVSS 4.0 9.5, in security bulletin KB3137947 published 2026-07-13 (ServiceNow, 2026-07-13; ENISA EUVD, 2026-07-13). Per ServiceNow, the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform" — an isolation failure in the AI Platform's code-execution environment. ServiceNow states it "addressed this vulnerability by deploying a security update to hosted instances," provided updates to self-hosted customers and partners, and is "not currently aware of exploitation against ServiceNow instances" (ServiceNow, 2026-07-13). Fixed releases are Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2 and Brazil EA/GA. Because hosted instances were remediated server-side by the vendor, the live exposure is narrowed to self-hosted and partner-managed deployments that have not yet applied the update — a population that still includes public-sector and critical-infrastructure operators running ServiceNow ITSM, HR-service-delivery and case-management on-prem or through partners.
This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.
We are not currently aware of exploitation against ServiceNow instances.
Current exploitation status: Actively exploited
The unauthenticated ServiceNow AI Platform sandbox escape has moved from "no known exploitation" to confirmed active exploitation. NCSC-CH's 2026-07-20 advisory revision set the item's status to "Actively exploited" (NCSC-CH, 2026-07-20), and BleepingComputer reports attackers "begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform," attributing the in-the-wild observation to threat-intelligence firm Defused from around 2026-07-18 (BleepingComputer, 2026-07-20). The mechanism is unchanged from the original entry — an unauthenticated caller reaches unrestricted server-side script execution through the GlideRecord query path, a chain Searchlight Cyber demonstrated where "running any code via eval or new Function will run free from the constraints of the additional sandbox" (Searchlight Cyber, 2026-07-14).
The operational change is entirely one of urgency: exploitation is live, so any self-hosted or partner-managed AI Platform instance still missing the vendor hotfix has crossed from "patch on the normal cycle" to "patch out of band."
Defender actions
- Apply ServiceNow hotfix KB3137947 to every self-hosted or partner-managed ServiceNow AI Platform instance immediately — the flaw is now exploited in the wild and ServiceNow's own hosted tenants are already fixed, so on-prem/partner-managed deployments are the exposure that remains.
Revision history
- Published 2026-07-13T2009Z-intel
- Update 2026-07-21T0409Z-intel
NCSC-CH updated its advisory on 2026-07-20 to flag CVE-2026-6875 — the pre-authentication sandbox escape in the ServiceNow AI Platform first covered here on 2026-07-13 — as actively exploited, with in-the-wild activity reported from 2026-07-18. ServiceNow's own hosted instances were already patched; self-hosted and partner-managed deployments that have not applied hotfix KB3137947 are the residual exposure, and this is now an out-of-band-priority item rather than a scheduled patch.
Changed: actions cves evidence priority sectors sources tags body
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Privilege Escalation TA0004
T1611Escape to Host
Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.