Hackers Exploit Critical ServiceNow Vulnerability in Active Attacks

Hackers are actively exploiting CVE-2026-6875, a critical ServiceNow AI Platform vulnerability that can allow an unauthenticated attacker to execute code on a vulnerable instance.

The flaw lets attackers reach a server-side JavaScript execution path before authentication and then escape ServiceNow’s restricted script sandbox. Successful exploitation could expose sensitive platform data and give attackers extensive control over the affected environment.

ServiceNow has patched hosted environments and released updates for self-hosted customers and partners. Organizations running their own instances should install the relevant security updates immediately.

CVE-2026-6875 Receives Critical 9.5 Severity Score

The National Vulnerability Database entry for CVE-2026-6875 describes the issue as a remote code execution vulnerability in the ServiceNow AI Platform.

ServiceNow assigned the vulnerability a CVSS 4.0 score of 9.5 out of 10. The rating reflects the possibility of severe confidentiality, integrity, and availability damage across the vulnerable system and connected environments.

The attack does not require a ServiceNow account or user interaction. However, the CVSS assessment lists high attack complexity, meaning exploitation depends on specific technical conditions and a successful sandbox escape.

Vulnerability detail	Information
CVE identifier	CVE-2026-6875
Affected product	ServiceNow AI Platform
Vulnerability type	Pre-authentication sandbox escape and remote code execution
CVSS 4.0 score	9.5, Critical
Authentication required	No
User interaction required	No
Attack complexity	High
Public disclosure date	July 13, 2026

How the ServiceNow Vulnerability Works

Searchlight Cyber researcher Adam Kues discovered that attacker-controlled data could reach ServiceNow’s GlideRecord query system. GlideRecord provides an application programming interface for querying tables inside the platform.

The problem occurred because ServiceNow query filters support JavaScript expressions. Under certain conditions, unauthenticated input could reach this functionality and trigger server-side script evaluation.

The Searchlight Cyber technical analysis identified a publicly accessible execution point in the /assessment_thanks.do endpoint.

Attackers Can Target the Assessment Endpoint

The vulnerable endpoint accepts a parameter named sysparm_assessable_type. ServiceNow passed the supplied value into a GlideRecord query involving the asmt_metric_type table.

An attacker could use a specially constructed JavaScript expression in this parameter. ServiceNow initially evaluated the script inside a restricted environment called GlideSystemSandbox.

The sandbox limits access to dangerous platform functions. Researchers found several techniques for escaping those restrictions and reaching more powerful server-side capabilities.

• Attackers can reach the vulnerable path without signing in.
• Malicious input passes through the sysparm_assessable_type parameter.
• The platform evaluates JavaScript inside a restricted sandbox.
• A successful sandbox escape enables wider code execution.
• The attack can compromise the ServiceNow instance and connected systems.

Active Attacks Use a Different Sandbox-Escape Method

Threat intelligence researchers at Defused reported observing in-the-wild exploitation shortly after the vulnerability became public.

The attacks targeted the same /assessment_thanks.do entry point documented by Searchlight Cyber. However, the observed payloads reportedly used a different sandbox-escape route to reach the same code-execution capability.

According to reporting on the active ServiceNow attacks, the first exploitation attempts were detected on Friday, July 17, four days after the CVE became public.

ServiceNow Has Not Linked Attacks to Its Hosted Instances

ServiceNow acknowledged the reports of exploitation activity but said its investigation had not found evidence connecting that activity to instances hosted by the company.

This distinction matters because ServiceNow began deploying protections to hosted environments before the public disclosure. Self-hosted installations may remain exposed when administrators have not installed the supplied updates.

The company continues to recommend that hosted and self-hosted customers confirm they have received the relevant patches or upgraded to a secure release.

Which ServiceNow Versions Are Affected?

The vulnerability affects ServiceNow AI Platform releases that predate the patched versions listed in the security advisory and CVE record.

The official CVE record identifies affected builds from the Australia, Yokohama, Zurich, and Brazil release families.

Customers should not rely only on the family name. They must compare the complete patch or hotfix level against the secure versions supplied by ServiceNow.

Release family	Upgrade requirement
Australia	Update to Australia Patch 2 or later
Yokohama	Update to Yokohama Patch 12 Hot Fix 1b, Yokohama Patch 13, or later
Zurich	Update to Zurich Patch 7b, Zurich Patch 9, or later
Brazil	Update to Brazil EA, Brazil GA, or a later secure release as directed by ServiceNow

Administrators should check their ServiceNow support account for the exact patch applicable to their deployment. Release availability can differ between hosted customers, self-hosted customers, and partners.

Successful Exploitation Could Compromise the Entire Instance

Searchlight Cyber said the vulnerability could lead to full compromise of a ServiceNow instance. The platform often contains valuable operational, employee, customer, and security information.

An attacker with server-side code execution could potentially access tables, bypass normal application controls, steal records, alter workflows, or create privileged accounts.

The research into the ServiceNow sandbox escape also warned that attackers could reach connected proxy systems. This includes MID Servers used to connect ServiceNow with internal networks and enterprise services.

Potential impact	Possible outcome
Platform data access	Theft of tickets, user records, configuration data, and business information
Administrative control	Creation of accounts or changes to roles and permissions
Workflow manipulation	Modification of automated business and IT processes
Credential exposure	Access to secrets, tokens, or credentials stored in platform records
MID Server access	Possible movement toward connected internal infrastructure

ServiceNow Released Updates Before Public Disclosure

Searchlight Cyber reported the vulnerability to ServiceNow on April 1, 2026. The vendor then began addressing the issue across hosted customer environments.

ServiceNow publicly disclosed CVE-2026-6875 and released the related security information on July 13. It also supplied security updates to self-hosted customers and partners.

The ServiceNow security advisory urges customers to apply the appropriate updates or move to a patched release as soon as possible.

Guarded Script Adds Another Layer of Protection

Organizations should also enable Guarded Script where supported. This feature restricts the JavaScript syntax allowed in sandboxed query expressions.

Guarded Script can block constructs that attackers commonly need when building complex sandbox-escape payloads. Restricted elements include assignments, function declarations, variable declarations, control-flow statements, and multiple statements.

This control can reduce the available attack surface, but administrators should not treat it as a replacement for installing ServiceNow’s security update.

• Apply the vendor patch before relying on configuration mitigations.
• Enable Guarded Script where the deployment supports it.
• Restrict direct internet access to administrative interfaces.
• Review the exposure of self-hosted ServiceNow instances.
• Limit communication between MID Servers and internal systems.

How to Look for CVE-2026-6875 Exploitation

Security teams should inspect web and application logs for unusual requests to /assessment_thanks.do, particularly requests containing the sysparm_assessable_type parameter.

Requests containing javascript:, encoded script fragments, unusually long values, or repeated errors deserve immediate investigation. Defenders should preserve relevant logs before restarting or updating affected systems.

Administrators should also review the environment for signs that an attacker gained access after exploiting the vulnerability.

1. Search logs for requests to /assessment_thanks.do.
2. Inspect values supplied through sysparm_assessable_type.
3. Identify JavaScript expressions and encoded payloads in query parameters.
4. Review recently created users, groups, roles, and administrator accounts.
5. Check for unexpected changes to scripts, workflows, business rules, and scheduled jobs.
6. Investigate unusual MID Server commands and outbound connections.
7. Rotate exposed credentials, tokens, and integration secrets.
8. Revoke suspicious sessions and API access.

Self-Hosted ServiceNow Instances Need Immediate Attention

ServiceNow manages patch deployment for its hosted platform, but organizations with self-hosted installations carry greater responsibility for confirming their update status.

Internet-facing deployments create the highest immediate risk because attackers can reach the vulnerable pre-authentication endpoint without obtaining credentials.

The latest CVE-2026-6875 exploitation report shows that attackers began testing the flaw within days of public disclosure. Delayed patching gives threat actors more time to refine payloads and identify exposed systems.

Organizations Should Patch Before Investigating Further

Administrators should first confirm that every ServiceNow instance runs a patched release. They should then review logs and system changes for evidence of activity that occurred before the update.

Applying a patch closes the vulnerability, but it does not remove accounts, scripts, tokens, or other changes created during an earlier compromise.

The ServiceNow CVE-2026-6875 advisory remains the primary source for customer-specific patch information. Organizations that cannot verify their status should contact ServiceNow support and restrict external access until they complete the update.

FAQ