ServiceNow runs some of the most sensitive workflows in the enterprise: incident management, IT service delivery, HR processes, and now AI-assisted automation. When a platform like that has a pre-authentication remote code execution flaw, the blast radius is every integrated system, every table, every proxy server that trusts it.
ServiceNow CVE-2026-6875 is a CVSS 9.5 pre-auth sandbox escape RCE in the AI Platform, now actively exploited. Threat intelligence firm Defused confirmed over the weekend that attackers are actively exploiting the flaw, with the first malicious payloads appearing on Friday, July 18. That is five days after ServiceNow released patches for self-hosted instances on July 13. The vulnerability, originally reported by Searchlight Cyber on April 1, lets an unauthenticated attacker escape ServiceNow's script sandbox and execute arbitrary code on the target instance.
The chart above tracks the timeline from discovery to active exploitation. The gap between patch availability and confirmed attacks is five days, and the vendor's advisory still has not been updated to reflect the threat.
What exactly is CVE-2026-6875?
The vulnerability lives in the structural gap between ServiceNow's two JavaScript execution layers. The inner sandbox is meant to safely evaluate user-influenced expressions. The outer context runs platform code with full privileges. The bridge between them is the problem.
ServiceNow's GlideRecord query API accepts a javascript: prefix in addQuery() calls, causing the platform to evaluate a JavaScript expression before using the result as a query argument. The pre-authentication endpoint /assessment_thanks.do accepts user-supplied input directly into one of these calls, giving an unauthenticated attacker a path into the inner sandbox. From there, the sandbox is supposed to contain the damage.
It does not. The function gs.include() loads ServiceNow's built-in script libraries and runs that loaded code in the outer, less-restricted execution context. The shared global scope between the two contexts is the structural gap: attacker code running inside the inner sandbox can modify global JavaScript objects, like Object.clone, that the loaded library code will then execute unsandboxed. Adam Kues of Assetnote, operating under the Searchlight Cyber umbrella, documented the specific gadget chain: override Object.clone with the Function constructor, set AbstractAjaxProcessor.prototype to the attacker payload, then call gs.include('ItemViewElementsProvider') to trigger execution outside the sandbox.
The result is arbitrary code execution with full platform access. Kues confirmed that the exploit allowed reading any table data, creating admin users, and running shell commands on connected proxy servers. The flaw is rated CVSS 9.5 and tracked in ServiceNow's advisory KB3137947.
Are the in-the-wild exploits using the same technique?
No, and that is the critical detail for anyone relying on signature-based defenses.
Defused's threat intelligence, reported by BleepingComputer on Saturday, confirmed that attackers are hitting the same pre-authentication entry point, /assessment_thanks.do, but using a different gadget chain to reach the same code-execution primitive. The published proof-of-concept from Searchlight Cyber documented one path. Defused has now confirmed a second.
This matters structurally. The underlying exploitable primitive, the ability to influence unsandboxed code execution via the gs.include() bridge, is reachable through any gadget that can invoke the Function constructor within an included library's execution context. The existence of multiple independent gadget paths means that any defense targeting the specific sequence of operations documented in the PoC will fail against an attacker using an alternative route. A WAF rule tuned to the specific property overrides, a network pattern matched to the known payload structure: none of it holds against a variant.
The only defense that closes all routes simultaneously is patching the underlying vulnerability. The patch ships with a new architectural control called Guarded Script, which restricts the inner sandbox to single, simple expressions. Variable declarations, control flow statements like if, switch, for, and while, function declarations, assignment operators, and multi-statement scripts are all blocked. Because every known gadget chain for this class of vulnerability requires multi-step code manipulation, the Guarded Script restrictions remove the preconditions for any gadget chain, not just the one Searchlight Cyber documented.
Why has ServiceNow not updated its advisory to reflect active exploitation?
As of the morning of July 20, ServiceNow's official advisory still states that the company is "not currently aware of exploitation against ServiceNow instances." This is despite Defused's public confirmation of active exploitation that began two days earlier.
A ServiceNow spokesperson told BleepingComputer that the company is "aware of a cybersecurity company's recent publication regarding exploitation activity" but has "not observed evidence that this activity is related to instances that ServiceNow hosts." The spokesperson encouraged all customers to apply patches if they have not already done so.
The distinction ServiceNow is drawing matters for hosted customers but does nothing for self-hosted ones. ServiceNow confirmed that hosted instances received fixes starting in April, with broader patches rolling out through June. Self-hosted instances got their patch on July 13. If you run self-hosted and have not applied that update, you are exposed to active exploitation, and the vendor's advisory language should not change your urgency.
What should self-hosted administrators do right now?
The action set is narrow and urgent. There is one real fix and several supporting steps.
- Apply the July 13 patch immediately. This is the only complete fix. The patch closes the vulnerability and enables Guarded Script, which structurally prevents the gadget chain class. Do not wait for ServiceNow to update the advisory to "actively exploited."
- Verify that Guarded Script is enabled. The patch ships with the feature, but you should confirm it is active on your instance. Without it, you are running a point fix that closes the known path but leaves the structural gap open.
- Audit access to
/assessment_thanks.do. If you can restrict network access to this endpoint at a reverse proxy or load balancer for untrusted networks, do it now as defense in depth. It will not stop an authenticated attacker or a variant hitting a different endpoint, but it reduces the pre-auth attack surface. - Check for indicators of compromise. Kues confirmed the exploit allows reading any table data, creating admin users, and running shell commands on proxy servers. Review newly created admin accounts, unexpected script execution logs, and anomalous GlideRecord queries containing
javascript:prefixes in your audit logs. - Do not rely on WAF rules or signature blocks. Defused has already confirmed a second gadget chain. Any rule tuned to the published PoC is obsolete.
If you are on a hosted instance, ServiceNow applied fixes months ago. Confirm with your account team that your instance received the April and June updates, but the acute risk is lower. The threat is concentrated on self-hosted deployments that have not patched.
How does this compare to other urgent patch windows?
The five-day gap between patch release and confirmed exploitation is tight but not unusual for critical CVEs in widely deployed platforms. We have seen similar windows in the SharePoint CVE patch clock and the Splunk SIEM patch window. The pattern is consistent: once a critical RCE is disclosed, exploitation follows within days, not weeks.
What makes this one different is the gap between the vendor's advisory language and the threat intelligence reality. When a vendor says "not currently aware of exploitation" while a reputable threat intel firm publishes payloads it is actively observing, operators get caught between two signals. The operator's rule should be simple: trust the threat intel, not the advisory. Advisories get updated on the vendor's timeline. Exploitation happens on the attacker's.
This also connects to a broader pattern in AI platform security. The Hugging Face autonomous agent breach showed how AI infrastructure amplifies attack surface. ServiceNow's AI Platform sits in a similar position: it is a PaaS that integrates AI into core enterprise workflows, which means a compromise here cascades into every downstream system the platform touches.
The patch is the only answer
WAF rules, network ACLs, and signature blocks are all temporary measures that fail the moment an attacker finds a new gadget chain. Defused has already confirmed that happened. The structural fix is the patch plus Guarded Script. If you run a self-hosted ServiceNow instance and have not applied the July 13 update, treat this as a P0. The attackers are already there.
Sources
- BleepingComputer - Critical ServiceNow code execution flaw now exploited in attacks
- Help Net Security - ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)
- ServiceNow Support - CVE-2026-6875 Sandbox Escape in ServiceNow AI Platform
- TechTimes - Attackers Exploit ServiceNow CVE-2026-6875 via Multiple Sandbox-Escape Routes
- The Hacker News - Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
