A critical pre-authentication remote code execution vulnerability in the ServiceNow AI Platform, tracked as CVE-2026-6875, is under active exploitation. Attackers began hitting the flaw within days of public disclosure, and the observed intrusions use a different sandbox-escape gadget than the one documented in the original research — a sign that the underlying bug class is more exploitable than the initial write-up suggested.

What Happened

Researchers at Searchlight Cyber found that ServiceNow’s GlideRecord query API — the interface most server-side scripts use to read platform data — accepts a javascript: prefix inside addQuery() calls. When that prefix is present, the platform evaluates the JavaScript expression before using the result as a query argument, effectively handing an attacker a code-execution primitive inside ServiceNow’s scripting sandbox. The pre-authentication sink for this behavior sits at the /assessment_thanks.do endpoint, which is reachable without any credentials on a default instance.

Searchlight reported the bug to ServiceNow on April 1, 2026. ServiceNow pushed a fix to its own hosted instances the next day and rolled patches out to self-hosted customers and partners through June. The vulnerability was publicly disclosed on July 13, and by July 19 — roughly a week later — Defused and other researchers observed the first exploitation attempts in the wild, with abuse confirmed continuing through the weekend of July 18-19.

Notably, the in-the-wild payloads target the same /assessment_thanks.do endpoint documented in Searchlight’s research but use a different sandbox-escape gadget to reach the same code-execution outcome. That divergence matters operationally: detection rules written narrowly around the published PoC’s exact payload will miss this variant.

Technical Details

  • CVE: CVE-2026-6875
  • CVSS: 9.5
  • Vulnerability class: Sandbox escape / code injection via unauthenticated pre-auth endpoint
  • Root cause: GlideRecord’s addQuery() evaluates a javascript:-prefixed argument as executable script before treating it as a query value
  • Entry point: /assessment_thanks.do, accessible without authentication
  • Fixed in: Brazil EA and Brazil GA, Australia Patch 2, Zurich Patch 7b and Patch 9, Yokohama Patch 12 Hot Fix 1b and Patch 13

Successful exploitation gives an attacker code execution inside a ServiceNow instance’s server-side scripting context, which on this platform is a far more privileged position than it sounds: from there, an attacker can query and exfiltrate any table data the instance holds, create administrator accounts to establish persistence, and — where an instance has MID Server integrations configured — potentially reach further into a customer’s internal network through those proxy connections. ServiceNow instances routinely hold HR records, IT asset inventories, security-incident data, and integration credentials for connected enterprise systems, so a fully compromised instance is rarely a contained blast radius.

Impact

ServiceNow’s AI Platform underpins ITSM, HR case management, and security-operations workflows at a large share of large enterprises, and internet-facing instances are common because customer-facing service portals and self-service workflows depend on public reachability. Any instance still running a pre-patch release is exposed to unauthenticated remote code execution — no phishing, no credential theft, no insider access required. Given the roughly three-month gap between the April patch for hosted customers and July’s public disclosure, the population still running vulnerable self-hosted or delayed-patch instances is likely non-trivial.

Mitigation

  • Patch immediately to Brazil EA/GA, Australia Patch 2, Zurich Patch 7b/9, or Yokohama Patch 12 Hot Fix 1b/13, per your release track.
  • If patching cannot happen immediately, restrict external network access to /assessment_thanks.do and other public-facing service-portal endpoints via WAF or reverse-proxy rules as a stopgap.
  • Hunt for anomalous requests to /assessment_thanks.do in web server and ServiceNow transaction logs, unexpected server-side script execution, newly created administrator accounts, and unusual outbound connections from MID Server hosts.
  • Because the observed attacks use a gadget chain distinct from the published PoC, don’t rely solely on signature detection tuned to the original research — monitor for the behavioral indicators (unexpected process creation, unauthorized data access) rather than a single payload signature.
  • Review ServiceNow’s advisory (KB3137947) for the authoritative patch matrix and any updated indicators as the vendor’s investigation continues.

Given confirmed in-the-wild exploitation of an unauthenticated RCE in widely deployed enterprise infrastructure, expect this to land on CISA’s Known Exploited Vulnerabilities catalog shortly if it hasn’t already — federal and enterprise patch teams should treat it with KEV-level urgency regardless.