ServiceNow's AI Platform — the engine behind more than 100 billion enterprise workflows per year at 85% of Fortune 500 companies — has a critical vulnerability that lets unauthenticated attackers execute arbitrary code on any unpatched instance. CVE-2026-6875 is being actively exploited in the wild, and the exploit landscape is already broader than the published proof-of-concept reveals.
What Is CVE-2026-6875?
CVE-2026-6875 is a pre-authentication remote code execution vulnerability in the ServiceNow AI Platform, formerly called the Now Platform. It allows any attacker with network access to a vulnerable instance — no credentials required — to escape the platform's script sandbox and run arbitrary code remotely. The flaw was discovered by Adam Kues of Searchlight Cyber, who reported it to ServiceNow on April 1, 2026.
ServiceNow patched hosted instances the following day and rolled out fixes for self-hosted customers and partners throughout June, ahead of the July 13 public disclosure. But five days later, on July 18, threat intelligence firm Defused confirmed active exploitation in the wild.
How the Attack Works
The vulnerability lives in how ServiceNow handles unauthenticated input through its GlideRecord query API. Attackers target the /assessment_thanks.do endpoint, where the sysparm_assessable_type parameter is passed directly into a GlideRecord query — with no authentication at all.
The key trick: ServiceNow's query engine supports javascript: expressions in filter contexts. When a specially crafted JavaScript filter value is supplied, the platform evaluates attacker-controlled code before executing the query. Normally, this execution is confined to a restrictive sandbox that blocks eval, function declarations, and dangerous Java classes.
The sandbox has a loophole: gs.include(), a mechanism for loading ServiceNow Script Includes. Searchlight Cyber's research showed that Script Includes execute in a less restricted context than the surrounding sandbox, creating a direct path to arbitrary code execution.
Multiple Exploit Routes Already in the Wild
Defused's threat intelligence, posted to X on Saturday, confirmed that attackers are hitting the same /assessment_thanks.do entry point documented by Searchlight Cyber — but using a different gadget chain to reach the same code-execution primitive. That means organizations that tried to block the known technique rather than patch the underlying flaw are not protected.
The first malicious payloads appeared on Friday, July 18 — five days after ServiceNow released patches — and exploitation is ongoing. No specific advanced persistent threat group has been publicly attributed, but the rapid development of alternative gadget chains suggests both opportunistic cybercriminals and potentially sophisticated adversaries are in play.
Why This One Matters
The combination of three factors makes CVE-2026-6875 an emergency rather than a scheduled patching item:
Zero authentication required. Any attacker with network access to a vulnerable instance can trigger the flaw — no credentials, no phishing, no prior foothold.
Massive deployment surface. ServiceNow processes over 100 billion enterprise workflows annually and powers more than 100,000 enterprise AI applications across 85% of Fortune 500 companies. The blast radius of any unpatched instance is enormous.
Multiple gadget chains in the wild. Blocking a single exploit path is not enough — attackers are already using alternative sandbox-escape routes to reach the same primitive.
What to Do Right Now
If your organization runs a ServiceNow instance — hosted or self-managed — here's the immediate checklist:
Patch immediately. ServiceNow released fixes on July 13. If you haven't applied them yet, this is a drop-everything situation.
Block the endpoint. Until patching is confirmed across all instances, restrict access to
/assessment_thanks.doat the network or WAF level.Audit for exploitation. Check logs for suspicious requests to the vulnerable endpoint, particularly those containing
javascript:in parameters or unusualgs.include()calls. Look for indicators of compromise like unexpected Script Include creation or outbound connections from the ServiceNow process.Review your instance exposure. If your ServiceNow instance is internet-facing, assume it may have been targeted. The barrier to exploitation is extremely low.
The Bigger Picture
CVE-2026-6875 is a textbook case of why sandbox-escape vulnerabilities in enterprise platforms are so dangerous. ServiceNow's sandbox was designed to prevent exactly this kind of abuse — but a single overlooked code path (gs.include() executing in a less restricted context) turned a defense-in-depth architecture into a single point of failure.
With 85% of Fortune 500 companies relying on the platform for AI-powered workflows, the potential blast radius extends far beyond any single organization. If you're running ServiceNow, patch now and audit your logs. The five-day gap between patch release and active exploitation is already closed — attackers are in the wild, and they're not waiting.
Published July 21, 2026 · Tags: CVE-2026-6875, ServiceNow, RCE, sandbox-escape, pre-auth, enterprise
Top comments (0)