Attackers are exploiting a critical sandbox escape in the ServiceNow AI Platform that hands them unauthenticated code execution on the instance. CVE-2026-6875 carries a CVSS score of 9.5, requires no credentials, and according to disclosure firm Searchlight Cyber leads to complete compromise of the ServiceNow instance and every proxy server connected to it. Threat intelligence firm Defused Cyber reported in-the-wild exploitation on July 21, 2026, with captured payloads matching Searchlight's public proof-of-concept. Patches have been available since June. If you run a self-hosted instance and have not applied them, treat this as an incident-prevention task for today, not a change-window item.
CVE-2026-6875 is a sandbox escape in the ServiceNow AI Platform. ServiceNow, like most low-code and AI-enabled platforms, executes user- and workflow-supplied code inside a restricted sandbox to prevent that code from reaching the underlying host or instance internals. This flaw breaks out of that boundary. Once the sandbox constraint is gone, an attacker's input is no longer sandboxed script; it is arbitrary code running with the platform's own privileges.
The critical multiplier here is that the exploit is reachable pre-authentication. Defused Cyber observed exploitation against the endpoint '/assessment_thanks.do' using HTTP POST requests. That endpoint is exposed without a valid session, which means an attacker does not need stolen credentials, a phishing foothold, or an insider. Internet-facing exposure plus an unpatched build is the entire prerequisite.
⚠️
Pre-auth RCE means no login step to detect— Because CVE-2026-6875 is exploitable before authentication, there is no failed-login pattern, credential-stuffing spike, or MFA prompt to alert on. The first observable signal may be the code execution itself. Hunt on POST requests to /assessment_thanks.do and unexpected child processes or outbound connections from the ServiceNow application tier.
A ServiceNow instance is rarely an island. It typically holds IT service management data, asset and configuration records, workflow automation, and stored credentials for the systems it integrates with. Searchlight Cyber's disclosure states the flaw allows complete compromise of the instance as well as all connected proxy servers. That turns a single vulnerable platform into a pivot point into the rest of the environment.
Searchlight Cyber reported the issue to ServiceNow on April 1, 2026. ServiceNow rolled out fixes throughout June across its supported release trains. Defused Cyber flagged active exploitation on July 21, roughly 111 days after the initial report and within weeks of patches becoming available. That compression, from vendor fix to in-the-wild exploitation, is the recurring pattern for high-severity enterprise flaws with a public PoC: the disclosure that helps defenders patch also arms attackers who reverse the fix.
Defused's reporting included one correction worth noting for accuracy. The firm initially suggested the observed payload reached the same code-execution primitive by a different route than the published PoC, then corrected itself to confirm the captured payload matches Searchlight Cyber's PoC. In practical terms, attackers are firing the public exploit, not a bespoke variant.
After publication, a ServiceNow spokesperson told The Hacker News the company has not observed evidence of exploitation to date, and specifically that it has seen no activity related to instances ServiceNow itself hosts. ServiceNow reiterated that patches are available and urged both self-hosted and ServiceNow-hosted customers to apply them, offering direct assistance to customers who need help. Note the scope of the statement: it addresses ServiceNow-hosted infrastructure. Self-hosted instances sit outside the vendor's telemetry, and Defused's exploitation reporting was not limited to hosted environments. Absence of evidence on the vendor's own fleet is not evidence of absence across every self-managed deployment.
Patch matrix— Apply the fixed build for your release family: Brazil EA and Brazil GA; Australia Patch 2; Zurich Patch 7b or Zurich Patch 9; Yokohama Patch 12 Hot Fix 1b or Yokohama Patch 13. ServiceNow is also hardening the platform by severely restricting the type of code permitted to run in sandbox contexts, per researcher Adam Kues.
The through-line is simple. This is a CVSS 9.5, unauthenticated, PoC-armed remote code execution flaw in a platform that typically sits at the center of IT operations and holds the credentials to reach everything else. Patches exist. The gap between having a fix and applying it is the entire attack surface here, and attackers are already inside that gap.
Originally published on RedEye Threat Intelligence.