ServiceNow CVE-2026-6875 has crossed from disclosed enterprise bug to active exploitation, putting unpatched ServiceNow AI Platform instances on an immediate incident-response clock. Attackers have begun exploiting the critical pre-authentication remote code execution flaw, according to threat intelligence firm Defused, as reported by Help Net Security.
ServiceNow CVE-2026-6875 is now being used in live attacks
The core risk is brutally simple: attackers don't need credentials to try exploiting this bug. CVE-2026-6875 is a code injection vulnerability in the ServiceNow AI Platform that can let an unauthenticated attacker escape ServiceNow's script sandbox and execute code remotely on a targeted instance. ServiceNow AI is a Platform-as-a-Service used to build and automate digital workflows, which makes the location of the flaw more sensitive than a narrow single-purpose application bug.
Searchlight Cyber researchers found the vulnerability and reported it to ServiceNow in early April 2026. ServiceNow pushed a security update to hosted instances the next day, while patches and security updates for self-hosted customers and partners were made available last week, according to Help Net Security. The existence of ServiceNow CVE-2026-6875 was publicly revealed on July 13.
Defused researchers said the first exploitation attempts appeared on Friday and confirmed active in-the-wild abuse over the weekend. The observed payloads targeted the same pre-authentication endpoint, /assessment_thanks.do, that Searchlight Cyber documented publicly. The twist is worse for defenders: attackers reached the same code-execution primitive through a different sandbox-escape route than the one in the published proof-of-concept.
The strongest counterpoint is that this is not described as a low-effort exploit. Searchlight Cyber researcher Adam Kues characterized it as exploitable in high-complexity attacks, Help Net Security reported. But the same research described the payoff as unauthenticated code execution and full compromise of the ServiceNow instance and any connected proxy servers, which is why high complexity doesn't make this safe to park in a normal patch queue.
Pre-authentication RCE puts workflow systems directly in the blast radius
The pre-authentication angle is what turns ServiceNow CVE-2026-6875 from a vendor advisory into a live enterprise exposure problem. A vulnerable internet-facing instance can be probed before an attacker has a username, password, token, or foothold. That sharply raises urgency for self-hosted deployments that have not yet applied the July 13th update.
The NVD record for CVE-2026-6875 lists the vulnerability as CWE-94, improper control of code generation, and shows a CVSS-B 9.5 CRITICAL score from ServiceNow under CVSS 4.0. NVD says its own enrichment is still pending, but the vendor-supplied vector includes network attackability, no privileges required, and no user interaction required. That aligns with the operational concern now emerging from Defused's exploitation report.
“This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.”
That ServiceNow language in the CVE record also says the company was “not currently aware of exploitation against ServiceNow instances.” Defused's weekend finding changes the live-risk picture after that earlier advisory text. XOOMAR analysis: this is the normal compression cycle for serious enterprise bugs, disclosure, technical write-up, attacker adaptation, and then a race between patching and exploitation.
| Deployment path | Source-backed status | Immediate security implication |
|---|---|---|
| Hosted ServiceNow instances | ServiceNow pushed a security update after the early April report | Customers should verify update status and review logs |
| Self-hosted instances | Patches and security updates were made available last week | Unpatched systems should be treated as high-priority exposure |
| Publicly reachable instances | Exploitation hits /assessment_thanks.do | Logs for that endpoint deserve immediate review |
Sandbox escape matters because sandboxing is supposed to limit what scripts can do inside the platform. If attackers can break that boundary, the scripting layer stops being a containment line and becomes a path to code execution. The security updates also carry Guarded Script, a new ServiceNow feature that restricts the type of code that can run in sandbox contexts, making future sandbox escapes less likely, according to Help Net Security.
For teams tracking how patch deadlines collide with operational risk, this sits near the same security-operations problem XOOMAR covered in Windows 10 Security Updates Now Trap One in Six PCs. The ServiceNow case is different, but the pressure is familiar: a public fix exists, attackers are moving, and defenders need clean visibility into what was exposed before patching.
Security teams should patch first, then hunt for sandbox-escape traces
The priority is not debate, it's verification. Administrators of self-hosted ServiceNow AI Platform instances that have not applied the July 13th update should do so now, especially where instances are reachable from the public internet. Hosted customers should confirm their update status rather than assuming the deployment path is enough.
Security teams should also reduce exposure where they can. XOOMAR analysis: until patch status and compromise status are both clear, access restrictions, tighter network controls, and review of unnecessary integrations are practical containment moves. Those steps don't replace patching, but they can shrink the number of paths an attacker can test while teams investigate.
Immediate hunting should focus on evidence tied to the reported exploitation path and the risk model of the bug:
- Endpoint activity: Review requests to /assessment_thanks.do, especially anomalous pre-authentication traffic.
- Script behavior: Check for unexpected script execution or signs that sandbox limits were bypassed.
- Admin changes: Look for new privileged users, altered roles, or unexplained configuration changes.
- Integrations: Review new or modified integrations that could move data or extend access.
- Outbound traffic: Investigate unusual connections from ServiceNow infrastructure after suspicious requests.
This is also a reminder that workflow platforms can become high-value intrusion points when they sit close to tickets, employee processes, automation, and operational records. We saw a different side of breach response pressure in Fairlife Cyberattack Turns Coke Unit Into 17th US Cyber Hit, where the lesson for security teams was the same at a higher level: speed matters once attackers have a path in.
The near-term watch item is whether exploitation remains focused on opportunistic scanning of unpatched instances or starts appearing inside broader ransomware, espionage, or supply chain campaigns. There is no source-backed confirmation of that broader pattern yet. What would prove the risk is contained is a patching wave, limited exploit telemetry, and no credible reports of post-exploitation activity beyond initial attempts.
Impact Analysis
- CVE-2026-6875 allows pre-authentication remote code execution, meaning attackers do not need valid credentials.
- Active exploitation raises urgency for unpatched ServiceNow AI Platform instances.
- Attackers are using a different sandbox-escape route than the public proof-of-concept, complicating detection and response.
Originally published on XOOMAR. For more news and analysis, visit XOOMAR.
Top comments (0)