CVE-2026-6875 is a critical vulnerability in the ServiceNow AI Platform (formerly Now Platform) that allows for remote code execution without authentication, with a CVSS severity of 9.5. Publicly disclosed on July 13, 2026, and actively exploited since July 18, it leaves instances exposed to the risk of total compromise. This article explains what happened, the real impact, and the response steps your organization should take now.
What is the ServiceNow vulnerability CVE-2026-6875?
CVE-2026-6875 is classified as a sandbox escape Pre-authentication: a vulnerability that allows an attacker to escape the restricted script execution environment of the server and run arbitrary code on the instance without needing valid credentials. The ServiceNow AI Platform is the layer that underpins most of the platform's ITSM, ITOM, and workflow automation tools, which broadens the impact surface of the vulnerability.
The CVSS score of 9.5 reflects the combination that makes this vulnerability especially serious: remote code execution, lack of authentication requirement, and a platform that often occupies the center of IT operations for large organizations.
Timeline of disclosure and exploitation
| Date | Event |
|---|---|
| 01/04/2026 | Researchers at Searchlight Cyber (Assetnote) report the vulnerability to ServiceNow. |
| April/2026 | ServiceNow applies a fix to the instances it hosts. |
| June 2026 | Patches and security updates are made available to self-hosted customers and partners. |
| 13/07/2026 | Public disclosure of CVE-2026-6875 and the technical details of Searchlight Cyber. |
| 18/07/2026 | The threat intelligence firm Defused is observing the first attempts at exploitation. in-the-wild. |
How the attack works
The observed vector reaches a pre-authentication flow through the endpoint. /assessment_thanks.do. A parameter controlled by the attacker is passed to the GlideRecord query API, whose filter handling accepts expressions of the type javascript:. When malicious input is processed, it creates a script execution path before any identity verification.
One detail increases the risk: Defused observed that the actual attempts hit the same entry point documented by Searchlight Cyber, but through a different route. gadget chain Unlike the published proof of concept, in practice, structural vulnerabilities are not limited to a single exploitation path, which reduces the effectiveness of defenses tailored only to the original PoC.
What is the real impact on the operation?
According to Searchlight Cyber, a successful exploit could allow the reading of sensitive platform data, the creation of administrative accounts, and the execution of commands through MID Servers and configured proxy infrastructure. Because the MID Server connects the instance to internal systems, the compromise could extend beyond the ServiceNow environment.
For the business, this means that an attacker who takes over the platform doesn't just reach an isolated server: they reach the incident orchestration system, the configuration database (CMDB), process automation, and AI-supported workflows. Potential exposure includes operational logs, configuration data, and the integrations that connect the instance to the corporate network.
The position of ServiceNow and threat intelligence.
The two reports need to be read together. ServiceNow stated that, based on its investigation so far, it has not observed evidence that the reported activity is related to instances that the company itself hosts, and reinforced its recommendation to apply the patches. Defused, on the other hand, claims to have observed active exploitation of the vulnerability since July 18th.
The practical approach is straightforward: regardless of the task assignment, a patch and a technically proven vector are available. Outdated self-hosted instances pose the greatest risk because remediation depends on action from the client.
What to do now: response steps
- Apply the patch or update to a corrected release. Consult the official ServiceNow advisory (article KB3137947) to confirm the patched versions and release families applicable to your instance.
- Enable the Saved Script. ServiceNow introduced this control to strongly restrict the code allowed in sandbox contexts, reducing the likelihood of new pre-authentication escapes.
- Reduce exposure. Limit external access to non-essential endpoints and reassess the instance's public surface area.
- Monitor MID servers and proxies. Check for anomalous activity, newly created administrative accounts, and suspicious requests to the affected endpoint.
- Treat the case as a critical supplier incident. Document the exposure, the remediation plan, and the post-patch verification within your risk governance.
Why this is a critical supplier risk
Platforms like ServiceNow focus on essential operational functions, which places them within the scope of operational resilience regulations. From the perspective of DORA (Digital Operational Resilience Act), A provider of this size tends to be listed in the ICT third-party registry, with mapped dependencies and a continuity plan in case the platform fails or is compromised. CVE-2026-6875 also reinforces that the security of the enterprise AI layer is an attack surface in the present, not a future debate.
How does 4MATT support the response to this ServiceNow vulnerability?
As a ServiceNow Elite Partner in Brazil, 4MATT provides structured responses to vulnerabilities on the platform, combining three approaches. The first is exposure identification: using ITOM Discovery and CMDB to map instances, releases, and MID Servers at risk. The second is remediation governance: planning and verifying patching within Managed Services, with traceability before and after. The third is the discipline of... Security and governance in ServiceNow, aligning controls, evidence, and continuity with risk frameworks.
This approach connects the immediate technical response to information security management long-term perspective, treating the incident not as an isolated event, but as part of the platform's operational maturity. For platform context, see also What is ServiceNow?.
Frequently Asked Questions
What is CVE-2026-6875?
This is a critical pre-authentication remote code execution vulnerability (CVSS 9.5) in the ServiceNow AI Platform, stemming from a sandbox escape that allows code execution without valid credentials.
Is CVE-2026-6875 being actively explored?
Threat intelligence firm Defused reports active exploitation since July 18, 2026. ServiceNow claims to have observed no evidence linking the activity to instances it hosts. A patch is available and a technically proven attack vector exists.
Are my instances hosted by ServiceNow protected?
ServiceNow has announced that it will apply the fix to instances it hosts starting in April 2026. The greatest risk lies with self-hosted instances that have not yet applied the patch, as the update depends on customer action.
How do I know if my instance has been compromised?
Monitor requests to the endpoint. /assessment_thanks.do, Unexpectedly created administrative accounts and anomalous activity on MID Servers and proxies. Log and investigate any indicators before and after applying the patch.
What is a Guarded Script?
It is a control introduced by ServiceNow to strongly restrict the code allowed in sandbox contexts, reducing the likelihood of similar pre-authentication escapes in the future.