Active Exploitation of ServiceNow Pre‑Authentication RCE (CVE-2026-6875)

Key Takeaways

• CVE‑2026‑6875 is a critical pre‑authentication code‑injection flaw in the ServiceNow AI Platform that allows unauthenticated attackers to escape the script sandbox and run arbitrary code.
• The vulnerability was discovered by Searchlight Cyber researchers in early April 2026 and reported to ServiceNow, which issued a patch for hosted instances the next day and made updates available to self‑hosted customers throughout June.
• Public disclosure occurred on July 13, 2026, accompanied by a detailed technical write‑up from Searchlight Cyber.
• Defused observed active exploitation beginning Friday, July 11, 2026, with attackers targeting the pre‑authentication endpoint /assessment_thanks.do using a sandbox‑escape gadget that differs from the published proof‑of‑concept.
• Successful exploitation grants full control of the ServiceNow instance and any connected proxy servers.
• ServiceNow’s July 13 update includes the new Guarded Script feature, which restricts executable code in sandbox contexts and mitigates future sandbox‑escape attempts.
• ServiceNow clarified on July 20 that the observed wild exploitation does not affect its hosted instances, but urged all customers—hosted and self‑hosted—to apply the relevant patches.
• Administrators of unpatched self‑hosted instances should prioritize applying the July 13 update immediately to prevent compromise.

Vulnerability Overview
CVE‑2026‑6875 is classified as a critical pre‑authentication vulnerability affecting the ServiceNow AI Platform, a Platform‑as‑a‑Service offering that enables organizations to design and automate digital workflows. The flaw resides in the platform’s script sandbox, which is intended to isolate user‑supplied code for safety. By exploiting a code‑injection vector, an unauthenticated attacker can break out of this sandbox and execute arbitrary commands on the underlying ServiceNow instance. Because no authentication is required, the attack surface is exposed to anyone who can reach the instance over the network, making the vulnerability particularly dangerous for exposed or misconfigured deployments.

Discovery and Reporting Timeline
The vulnerability was first identified by researchers at Searchlight Cyber during routine security testing in early April 2026. Upon confirming the issue, they responsibly disclosed it to ServiceNow’s security team. ServiceNow responded swiftly, pushing a security update to its hosted instances on the very next day—April 5, 2026. Recognizing that many customers run self‑hosted instances, the vendor subsequently made patches and accompanying security updates available to those customers and their partners throughout the month of June, ensuring a broad remediation window before public disclosure.

Public Disclosure and Technical Details
On July 13, 2026, ServiceNow published a security advisory announcing CVE‑2026‑6875, accompanied by a CVE identifier and severity rating (CVSS v3.1 base score ≈ 9.8). The same day, Searchlight Cyber released a detailed technical blog post that walked through the root cause: a flaw in the way the platform processes certain assessment‑related endpoints, allowing crafted input to bypass sandbox restrictions. The post included a proof‑of‑concept (PoC) demonstrating how an attacker could achieve remote code execution (RCE) by injecting malicious scripts that the sandbox failed to sanitize.

Exploitation in the Wild
Defused, a threat‑intelligence firm, began monitoring for signs of abuse shortly after the public disclosure. Their analysts reported that the first exploitation attempts appeared on Friday, July 11, 2026, and confirmed active, in‑the‑wild abuse over the weekend. Observed payloads targeted the same pre‑authentication endpoint documented by Searchlight Cyber—/assessment_thanks.do—but the attackers employed a distinct sandbox‑escape gadget that reaches the same code‑execution primitive via a different route than the original PoC. This variation indicates that threat actors are actively adapting the exploit to evade detection signatures that might be based solely on the published PoC.

Impact of Successful Exploitation
When leveraged successfully, CVE‑2026‑6875 grants an attacker full control over the compromised ServiceNow instance. Because the platform often integrates with external systems—such as identity providers, ticketing tools, and custom applications—an attacker can pivot to those connected proxy servers and downstream services. Potential consequences include data exfiltration, unauthorized workflow manipulation, credential theft, and the deployment of persistent backdoors. The unauthenticated nature of the flaw amplifies the risk, as attackers do not need any prior foothold or credentials to initiate the attack.

Mitigation: Guarded Script and Patch Guidance
The security update released on July 13, 2026, not only patches the underlying code‑injection vulnerability but also introduces a new defensive mechanism called Guarded Script. Guarded Script enforces a stricter allow‑list of permissible operations within sandbox contexts, effectively reducing the likelihood that future sandbox‑escape techniques will succeed. ServiceNow recommends that all customers—whether using hosted or self‑hosted deployments—apply the relevant patches immediately. For self‑hosted instances, administrators should verify that the June‑distributed updates have been installed; if not, they must prioritize the July 13 update without delay.

ServiceNow’s Statement on Hosted Instances
On July 20, 2026, a ServiceNow spokesperson addressed concerns raised by the observed wild exploitation, stating: “ServiceNow is aware of a cybersecurity company’s recent publication regarding exploitation activity associated with a previously disclosed security vulnerability, identified as CVE‑2026‑6875. Based on our investigation to date, we have not observed evidence that this activity is related to instances that ServiceNow hosts.” The spokesperson reiterated that patches have been made available to all customers and urged continued vigilance, offering direct assistance to any organizations needing help with patch deployment.

Correction to Earlier Reporting
An earlier version of this article incorrectly stated that ServiceNow had pushed patches to customers only in the week preceding the public disclosure. The article has been amended to reflect the accurate timeline: patches were distributed to hosted instances on April 5, 2026, and made available to self‑hosted customers and partners throughout June 2026, well before the July 13 disclosure.

Recommended Actions for Administrators

1. Verify Patch Level – Confirm that your ServiceNow instance is running the July 13, 2026, update (or the June‑distributed patch for self‑hosted environments).
2. Enable Guarded Script – Ensure the new Guarded Script feature is activated; it provides an additional layer of defense against sandbox‑escape attempts.
3. Review Access Controls – Restrict network exposure of the /assessment_thanks.do endpoint where possible, and employ web‑application firewalls to block anomalous requests.
4. Monitor Logs – Look for unusual POST requests to assessment‑related endpoints, especially those containing atypical payloads or script‑like strings.
5. Engage Vendor Support – If patch application encounters issues, contact ServiceNow support promptly for guidance; they have committed to assisting customers with deployment challenges.

By following these steps, organizations can substantially reduce the risk posed by CVE‑2026‑6875 and protect their ServiceNow environments from active exploitation.