Threat actors have begun actively exploiting CVE-2026-6875, a critical pre-authentication vulnerability in the ServiceNow AI Platform that allows unauthenticated remote code execution through a script sandbox escape.
Threat intelligence firm Defused confirmed the first exploitation attempts surfaced on Friday, with active in-the-wild.
CVE-2026-6875 is a code injection flaw that lets attackers escape ServiceNow’s script sandbox and execute arbitrary code within a targeted instance without any authentication.
ServiceNow Sandbox Escape Flaw
ServiceNow pushed a security update to hosted instances the following day and rolled out patches for self-hosted customers and partners throughout June, ahead of the July 13 public disclosure.
The flaw stems from ServiceNow’s GlideRecord query API, which allows unauthenticated user input to be embedded in filter queries across the codebase.
Adam Kues found that supplying a specially crafted javascript: filter value causes the platform to evaluate attacker-controlled JavaScript before executing the query, though this execution is normally confined to a restrictive script sandbox with limited object and function access.
Both the documented proof-of-concept and the observed real-world attacks target the same pre-auth sink at /assessment_thanks.do, which passes the unauthenticated parameter sysparm_assessable_type directly into a GlideRecord query.
Searchlight Cyber’s published research demonstrated that the gs.include() function, used to load script-include libraries, executes in a less restricted context than the surrounding sandbox.
By clobbering global JavaScript objects such as Object.clone and manipulating properties like AbstractAjaxProcessor.prototype, an attacker can trick the include mechanism into compiling and running attacker-supplied code, effectively breaking out of the sandbox entirely.
Notably, Defused reports that the in-the-wild payloads reach the identical code-execution primitive documented in the public PoC, but through a different sandbox-escape gadget, indicating attackers independently engineered an alternate exploitation path rather than simply reusing it.
Successful exploitation grants full compromise of the affected ServiceNow instance, including unrestricted table access, creation of administrator accounts, and command execution on any connected MID Server proxy infrastructure sitting inside a target’s internal network.
This makes the flaw particularly dangerous for enterprises that rely on ServiceNow as a workflow and IT service management backbone.
ServiceNow has stated it has not observed evidence linking the exploitation activity to instances it directly hosts, though it continues urging self-hosted and hosted customers alike to apply relevant patches.
The vendor’s fixes span multiple release families, including Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, and Yokohama Patch 12 Hot Fix 1b/Patch 13.
Alongside the patches, ServiceNow introduced “Guarded Script,” a hardening feature detailed in KB2944435 that restricts sandbox scripts to single, simple expressions blocking variable declarations, control flow, function declarations, and multi-statement scripts to close off future sandbox-escape avenues.
Mitigation
Organizations running self-hosted ServiceNow instances that have not applied the July 2026 security updates should do so immediately given confirmed active exploitation.
Security teams should also monitor requests to /assessment_thanks.do and similar pre-auth endpoints for anomalous javascript: filter payloads as a detection strategy while patching is completed.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
