--- schema: 1 kind: vulnerability title: > CVE-2026-6875 — ServiceNow AI Platform sandbox escape lets an unauthenticated request execute code on the platform (CVSS 9.5) headline: > ServiceNow patches an unauthenticated code-execution sandbox escape in its AI Platform; self-hosted and partner-managed instances are the residual exposure summary: > ServiceNow disclosed CVE-2026-6875 (CVSS 9.5), a sandbox escape in the ServiceNow AI Platform that, in certain circumstances, lets an unauthenticated user execute code within the platform. ServiceNow addressed its hosted instances starting in April and released updates for self-hosted instances on 2026-07-13. Defused reports exploitation attempts in the wild from 2026-07-17, and NCSC-CH flagged the CVE as actively exploited on 2026-07-20, citing that reporting. ServiceNow's advisory says it is not aware of exploitation against ServiceNow instances, and its spokesperson says it has seen no evidence that the activity relates to instances it hosts. Self-hosted and partner-managed customers must apply the fixed release for their family now. discovered_at: "2026-07-13T20:34:00Z" updated_at: "2026-07-21T04:38:00Z" event_date: 2026-07-13 run_id: 2026-07-13T2009Z-intel priority: high immediate_action: null tags: - vulnerabilities - rce - pre-auth - patch-available - ai-abuse - auth-bypass - actively-exploited regions: - global sectors: - public-sector - technology - finance - telco - healthcare entities: [] techniques: - T1190 - T1059.007 affected_products: - ServiceNow AI Platform cves: - id: CVE-2026-6875 cvss: "9.5" epss: null type: rce vector: zero-click auth: pre-auth status: - exploited - patch-available affected: self-hosted / partner-managed AI Platform instances below the fixed releases listed in KB3137947 fixed: Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2, Brazil EA/GA (KB3137947); hosted instances addressed from April sources: - url: "https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947" publisher: ServiceNow (vendor security KB / PSIRT) date: 2026-07-13 role: primary - url: "https://euvd.enisa.europa.eu/enisa/EUVD-2026-43520" publisher: ENISA EU Vulnerability Database date: 2026-07-13 role: corroborating - url: "https://security-hub.ncsc.admin.ch/#/posts/12778" publisher: NCSC-CH Cyber Security Hub date: 2026-07-20 role: primary - url: "https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/" publisher: BleepingComputer date: 2026-07-20 role: corroborating - url: "https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/" publisher: Searchlight Cyber date: 2026-07-14 role: corroborating closed_sources: [] evidence: - quote: "This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform." publisher: ServiceNow - quote: We are not currently aware of exploitation against ServiceNow instances. publisher: ServiceNow - quote: "Current exploitation status: Actively exploited" publisher: NCSC-CH Cyber Security Hub verification: multi-source sourcing_note: > ServiceNow's own security KB is the first-party authority for its product and the source for the fix; the ENISA EUVD record (EUVD-2026-43520) mirrors the same disclosure. NCSC-CH flags active exploitation, citing BleepingComputer's report of Defused's in-the-wild observations, and Searchlight Cyber published the technical analysis of the pre-authentication chain behind ServiceNow's 'certain circumstances' phrasing. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Apply the fixed release for your family listed in ServiceNow security bulletin KB3137947 (Zurich Patch 7b or 9, Yokohama Patch 12 Hot Fix 1b or Patch 13, Australia Patch 2, Brazil EA or GA) to every self-hosted or partner-managed ServiceNow AI Platform instance now. Exploitation attempts have been reported since 2026-07-17, and self-hosted instances are the ones ServiceNow did not fix itself." updates: - at: "2026-07-21T04:38:00Z" run_id: 2026-07-21T0409Z-intel type: update summary: > NCSC-CH updated its advisory on 2026-07-20 to flag CVE-2026-6875 — the pre-authentication sandbox escape in the ServiceNow AI Platform first covered here on 2026-07-13 — as actively exploited, with in-the-wild activity reported from 2026-07-18. ServiceNow's own hosted instances were already patched; self-hosted and partner-managed deployments that have not applied hotfix KB3137947 are the residual exposure, and this is now an out-of-band-priority item rather than a scheduled patch. fields: - actions - cves - evidence - priority - sectors - sources - tags - body merged_from: 2026-07-21/servicenow-ai-platform-cve-2026-6875-active-exploitation - at: "2026-09-30T06:45:01Z" run_id: 2026-09-30T0639Z-audit type: correction summary: > The summary still said no exploitation was known after the 2026-07-21 update recorded NCSC-CH's active-exploitation flag, and the takeaway said no hunt discriminator existed, misdated the hosted fix and called security bulletin KB3137947 a hotfix. The takeaway now leads with the /assessment_thanks.do sink the observed payloads hit, marks the gs.include() route as Searchlight Cyber's proof of concept, and notes the Guarded Script changes that ship with the patches. ServiceNow's statement that it is not aware of exploitation is set against the exploitation reports. The 2026-07-21 section no longer calls NCSC-CH's first advisory a revision or the exploitation confirmed, dates Defused's first attempts to 2026-07-17, and describes Searchlight's sandbox escape through gs.include() rather than eval. An uncited exposure clause is removed. fields: [summary, sourcing_note, verification, body, techniques, actions, cves] migrated_from: null --- ServiceNow disclosed CVE-2026-6875, a "Sandbox Escape in ServiceNow AI Platform" rated CVSS 4.0 9.5, in security bulletin KB3137947 published 2026-07-13 ([ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947); [ENISA EUVD, 2026-07-13](https://euvd.enisa.europa.eu/enisa/EUVD-2026-43520)). Per ServiceNow, the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform", an isolation failure in the AI Platform's code-execution environment. ServiceNow states it "addressed this vulnerability by deploying a security update to hosted instances," and provided updates to self-hosted customers and partners ([ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)). Fixed releases are Zurich Patch 7b/9, Yokohama Patch 12 Hot Fix 1b/13, Australia Patch 2 and Brazil EA/GA ([ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)). **Contradiction:** ServiceNow's advisory states that it is "not currently aware of exploitation against ServiceNow instances" ([ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)). BleepingComputer reported on 2026-07-20 that the advisory still said so and that ServiceNow had yet to flag the flaw as actively abused, and a ServiceNow spokesperson told it that, based on its investigation to date, it had not observed evidence that the activity is related to instances ServiceNow hosts ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)). Defused reports in-the-wild exploitation attempts since 2026-07-17 ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)), and NCSC-CH gives the exploitation status as actively exploited, citing that reporting ([NCSC-CH, 2026-07-20](https://security-hub.ncsc.admin.ch/#/posts/12778)). **Defender takeaway:** for self-hosted or partner-managed instances, apply the fixed release for your family (Zurich, Yokohama, Australia or Brazil) listed in KB3137947 rather than waiting for the next maintenance window ([ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)). The patches also include Guarded Script: complex server-side scripts (those using variables, if/else logic, loops or multiple statements) must be moved into a script include, and guest (unauthenticated) traffic is fully enforced immediately on upgraded instances. Enforcement for authenticated traffic phases in automatically over about four weeks on cloud instances, while on-premises administrators must advance each enforcement phase manually ([ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)). ServiceNow addressed hosted instances starting in April, and its spokesperson still encourages both self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)). The in-the-wild payloads Defused observed hit the same pre-authentication sink Searchlight Cyber documented, `/assessment_thanks.do`, but reach the code-execution primitive by a different route than Searchlight's published proof of concept ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)). Searchlight's route passes a `javascript:` expression in the `sysparm_assessable_type` parameter of that page, where it is evaluated inside a GlideRecord query, and then abuses `gs.include()` script-include evaluation to escape the sandbox ([Searchlight Cyber, 2026-07-14](https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/)). On self-hosted and partner-managed instances, hunt web access logs first for unauthenticated requests to `/assessment_thanks.do` carrying `javascript:` values in query parameters. `gs.include()` evaluation outside routine administrative workflows matches the published proof of concept, not necessarily the observed attacks. ## Update — 2026-07-21T04:38:00Z The unauthenticated ServiceNow AI Platform sandbox escape has moved from "no known exploitation" to reported active exploitation. NCSC-CH's advisory of 2026-07-20 gives the exploitation status as "Actively exploited" and cites news coverage of claims of active exploitation ([NCSC-CH, 2026-07-20](https://security-hub.ncsc.admin.ch/#/posts/12778)), and BleepingComputer reports attackers "begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform," attributing the in-the-wild observation to threat-intelligence firm Defused, which saw first attempts on 2026-07-17 ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)). Searchlight Cyber's analysis shows the mechanism: an unauthenticated caller gets server-side JavaScript evaluated through a GlideRecord query on a pre-authentication page, then escapes the script sandbox by obtaining the Function constructor through `Class.create.constructor` and running it during a `gs.include()` script-include evaluation, which ServiceNow runs without the sandbox's constraints ([Searchlight Cyber, 2026-07-14](https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/)). The operational change is entirely one of urgency: exploitation is live, so any self-hosted or partner-managed AI Platform instance still missing the fixed release has crossed from "patch on the normal cycle" to "patch out of band." ServiceNow's hosted/SaaS estate is already remediated, so exposure concentrates in on-prem and MSP-run deployments, which should be inventoried first. The hunt telemetry is in the takeaway above. ## Correction — 2026-09-30T06:45:01Z The summary above said no exploitation was known. BleepingComputer reports Defused observing first exploitation attempts on 2026-07-17, and NCSC-CH's advisory of 2026-07-20 flags the CVE as actively exploited, citing that news coverage ([NCSC-CH, 2026-07-20](https://security-hub.ncsc.admin.ch/#/posts/12778); [BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)). ServiceNow's advisory states that it is not currently aware of exploitation against ServiceNow instances ([ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)), and its spokesperson told BleepingComputer that it had not observed evidence that the activity relates to instances ServiceNow hosts ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)). The takeaway above also said no exploitation discriminator existed. The observed payloads hit the pre-authentication sink `/assessment_thanks.do` that Searchlight Cyber documented, by a different route than its published proof of concept ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/)). Searchlight's own route abuses `javascript:` values in GlideRecord query parameters and `gs.include()` evaluation ([Searchlight Cyber, 2026-07-14](https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/)). The sandboxed script cannot call `eval` or `new Function`, which the sandbox forbids. It reaches the Function constructor indirectly, through `Class.create.constructor`, and a `gs.include()` evaluation outside the sandbox then runs it ([Searchlight Cyber, 2026-07-14](https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/)). Its example request is a GET, not a POST. ServiceNow addressed hosted instances starting in April. 2026-07-13 is the release date of the self-hosted updates, and KB3137947 is the security bulletin listing the fixed releases, not a hotfix ([BleepingComputer, 2026-07-20](https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/); [ServiceNow, 2026-07-13](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)).