CVE-2026-6875Active Exploitation

CRITICALCVSS 9.5 · CRITICAL

Exploitation observed; activity peaked at 32 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Back to dashboard

8.5/ 10 priority

Sources & remediation

Other references

https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947

Weakness type (CWE)

CWE-94

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 74 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
116 mentions across 20 observed days

What's happening

Active exploitation reported across 74 signals
Exploit tool or code specified in 7 signals
PoC mentioned or linked in 18 signals
Patch or workaround mentioned in 58 signals
Technical details provided in 98 signals
Disclosure: 12 classified signals
Peaked 13d ago at 32 mentions (2026-07-21); latest day: 1
116 total mentions across 20 days

Deep dive

Activity timeline116 mentions / 20d

Signal classification6 categories

Active Exploitation

7363.5%

Patch

1916.5%

Disclosure

1210.4%

General

65.2%

PoC

43.5%

Exploit

10.9%

Referenced assets65 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-13	2	Disclosure1Patch1
2026-07-14	11	Disclosure2Patch8PoC1
2026-07-15	3	Disclosure1Patch2
2026-07-18	3	Active Exploitation3
2026-07-19	2	Active Exploitation1PoC1
2026-07-20	26	Active Exploitation20Disclosure1General1Patch4
2026-07-21	32	Active Exploitation26Disclosure1Exploit1General2Patch1PoC1
2026-07-22	16	Active Exploitation12Disclosure3General1
2026-07-23	4	Active Exploitation1Disclosure1Patch2
2026-07-24	3	Active Exploitation3
2026-07-25	2	Active Exploitation2
2026-07-26	1	Active Exploitation1
2026-07-27	1	PoC1
2026-07-28	3	Active Exploitation2Patch1
2026-07-29	1	General1
2026-08-06	1	Active Exploitation1
2026-08-17	1	General1
2026-09-12	2	Disclosure2
2026-09-14	1	Active Exploitation1

Full discourse20 posts

The Hacker News@TheHackersNews84d
Active Exploitation
⚠️ Attackers are exploiting a critical ServiceNow AI Platform flaw in the wild. CVE-2026-6875 is a pre-authentication sandbox escape that could let an unauthenticated attacker run arbitrary code. Self-hosted customers should check their patch status now. Details: https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html
Post summary
Attackers are actively exploiting CVE-2026-6875, a pre‑authentication sandbox escape on ServiceNow’s AI Platform that allows arbitrary code execution; self‑hosted users are urged to check and apply patches immediately.
15601854341.7K
2.3M followersView on X
Assetnote@assetnote91d
Disclosure
Our research team discovered a critical pre-authentication RCE inside ServiceNow by bypassing their scripting sandbox (CVE-2026-6875). You can read more here: https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/
Post summary
The message announces the discovery of a critical pre-authentication remote code execution vulnerability (CVE-2026-6875) in ServiceNow and links to a detailed research write-up.
14601507510.2K
10.5K followersView on X
Patrik Grobshäuser@ITSecurityguard91d
Disclosure
Pre-Auth Remote Code Execution in ServiceNow! (CVE-2026-6875) New research from @hash_kitten of the @SLCyberSec security research team is out 👀 😏 👇 https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/ PS: this might not be the last one 👁️👁️ 😉 https://t.co/vF5yNFneUZ
Post summary
Research has uncovered a Pre‑Auth RCE in ServiceNow (CVE‑2026‑6875) with a linked article for details; no active exploitation or mitigation information is provided.
04001576613.2K
31.8K followersView on X
Defused@DefusedCyber87d
Active Exploitation
⚠️ We are observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875) The payloads hit the same pre-auth sink @SLCyberSec documented (/assessment_thanks.do), but the sandbox-escape gadget reaches the same code-execution primitive by a different route than their published PoC. Defused subscribers can view the full gadget chain, request-level fingerprint, and exploit data. Track ServiceNow exploitation live 👉 http://console.defusedcyber.com/signup
Post summary
The post confirms live exploitation of ServiceNow CVE-2026-6875, noting the attacker’s use of a sandbox‑escape gadget that diverges from a previously published PoC, but provides no patch or exploit code details.
4225854530.5K
7.7K followersView on X
ボス@サイバーセキュリティの専門家@boss_sec_labo83d
Active Exploitation
SuicaのICチップが狙われ、自宅のIoT機器が不正送金の踏み台にされ、AIが攻撃者の武器になった。 VPNは突破され、1354万件の記録が紛失した。今日の8件は、どれもひとごとではない。・FeliCa ICチップCVE-2026-59776、Suica・PASMO読み取り改ざんの恐れ・家庭用IoT数万台が不正送金事件の踏み台に、NICT・総務省・警察庁が公表・GlobalProtect VPN CVE-2026-0257、Qilinランサムがネットワーク侵入に積極悪用・九州電力送配電SSD紛失、顧客情報最大1354万件の漏洩懸念・ServiceNow CVE-2026-6875、未認証RCEが公開数日で野外悪用・Hugging Face CEO警告、攻撃者はすでにAIエージェントを実攻撃に使っている・DrupalのAIプラグインにCVSS7.1の認証不備、アカウント乗っ取りの恐れ・MetaサポートAPIの認証不備、顧客情報アクセス可能で78,000ドルのバウンティ今日の8件に共通する入り口は、普通の機器と普通の設定だった。 Suicaのチップ、自宅のルーター、VPN、AIプラグイン。君の現場の「普通」は、まだ安全か？
Post summary
Multiple CVEs (e.g., CVE‑2026‑59776, CVE‑2026‑0257, CVE‑2026‑6875, etc.) were reported to be actively exploited in the wild, ranging from FeliCa chip tampering to unpatched VPN and RCE vulnerabilities, underscoring a surge in real‑world attacks.
010161335.4K
1.6K followersView on X
ZoomEye@zoomeye_team83d
General
🚨 CVE-2026-6875: Sandbox Escape in ServiceNow AI Platform Critical Vulnerability Alert! ServiceNow is affected by CVE-2026-6875. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-6875 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-6875" Search Dork: app="ServiceNow" Exposure: 936k instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJTZXJ2aWNlTm93Ig==&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260722 #Infosec #CyberSecurity #ZoomEye #DarkEye
Post summary
A notification of CVE-2026-6875 affecting ServiceNow AI Platform with exposure details and a link to analysis, but lacking PoC, exploit, or patch information.
0901863.3K
12.7K followersView on X
Stephen Marriott@stephenmarriott87d
Active Exploitation
A critical flaw in the ServiceNow AI platform allows unauthenticated users to run arbitrary commands. ⁦@DefusedCyber⁩ flagged this ServiceNow sandbox escape RCE as actively exploited. https://securityonline.info/cve-2026-6875-servicenow-sandbox-escape-rce/
Post summary
A critical flaw in ServiceNow’s AI platform allows unauthenticated RCE and has been reported as actively exploited in the wild.
04015102.4K
1.1K followersView on X
pdnuclei-bot@pdnuclei_bot83d
Disclosure
🚨 CVE-2026-6875 - critical 🚨 ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE > ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patch... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-6875 @pdnuclei #NucleiTemplates #cve
Post summary
A critical ServiceNow AI Platform vulnerability (CVE‑2026‑6875) is disclosed, describing a pre‑authentication sandbox escape that can lead to remote code execution; the post links to additional details but makes no claim of active exploitation or fixes.
020159952
1.3K followersView on X
kokumօtօ@__kokumoto86d
Active Exploitation
ServiceNowのサンドボックスエスケープCVE-2026-6875が悪用されている。ハニポ運用業のDefusedCyber社報告。 PoC（攻撃の概念実証コード）も公開済み。 https://securityonline.info/cve-2026-6875-servicenow-sandbox-escape-rce/
Post summary
CVE‑2026‑6875, a ServiceNow sandbox escape RCE, is reported as being exploited in the wild, and a PoC exploit code has already been published.
0201651.9K
7.7K followersView on X
kokumօtօ@__kokumoto91d
Patch
ServiceNowに重大(Critical)な脆弱性。CVE-2026-6875はCVSSv4スコア9.5のサンドボックスエスケープ。AI Platformにおける隔離境界が突破される可能性があるもの。技術的詳細は非開示。悪用未確認。修正版提供あり。 https://securityonline.info/servicenow-sandbox-escape-cve-2026-6875/
Post summary
CVE‑2026‑6875 is a critical sandbox‑escape vulnerability in ServiceNow with a CVSS v4 score of 9.5, yet no exploitation has been confirmed; however, a patch has been released.
030941.2K
7.7K followersView on X
dbugs@ptdbugs84d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-6875 PT ID: PT-2026-57852 Vendor: ServiceNow Product: ServiceNow AI Platform Description: ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-57852 • https://github.com/horkimhab/cve-2026-6875 #dbugs_vuln
Post summary
An exploit‑ready PoC for CVE‑2026‑6875 that enables unauthenticated RCE on ServiceNow AI has been released; no evidence of active exploitation or vendor patches are mentioned.
010113685
3.4K followersView on X
にゃん☆たく/takumi.a@taku888infinity91d
Patch
【セキュリティニュース】「ServiceNow AI Platform」にRCE脆弱性 - 修正版を提供（1ページ目 / 全1ページ）：Security NEXT https://www.security-next.com/187274 『脆弱性「CVE-2026-6875」について明らかにした。特定の条件下において脆弱性を悪用すると、サンドボックスを回避し、認証を必要とすることなくコードを実行できるという。』
Post summary
The post reports an RCE vulnerability (CVE-2026-6875) in ServiceNow AI Platform that allows code execution without authentication, and confirms that a patched version is now available.
0101032.0K
11.8K followersView on X
Daily CyberSecurity@Daily_CyberSec83d
Active Exploitation
Hackers are actively exploiting a critical ServiceNow RCE vulnerability (CVE-2026-6875) to bypass sandbox restrictions and breach corporate networks. #ServiceNow #Vulnerability #RCE #CVE20266875 #Cybersecurity #Infosec http://meterpreter.org/servicenow-rce-vulnerability/
Post summary
The tweet reports active exploitation of ServiceNow RCE (CVE-2026-6875) and links to a resource likely containing PoC material, but it lacks patch information or detailed exploit code.
11082549
12.9K followersView on X
moton@moton86d
PoC
CVE-2026-6875 PoC Disclosed: ServiceNow Sandbox Escape RCE - https://securityonline.info/cve-2026-6875-servicenow-sandbox-escape-rce/
Post summary
A proof of concept for CVE-2026-6875, a ServiceNow sandbox escape remote code execution vulnerability, has been disclosed with a link to the PoC.
001712.5K
756 followersView on X
Vivek | Cybersecurity@VivekIntel84d
Active Exploitation
Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026-6875 https://securityaffairs.com/195723/ai/attackers-exploit-critical-servicenow-rce-flaw-cve-2026-6875.html
Post summary
The article announces attackers are actively exploiting a critical ServiceNow RCE flaw (CVE-2026-6875). No PoC or exploit code is disclosed, nor is a patch or workaround mentioned.
00053798
18.1K followersView on X
The CyberSec Guru@thecybersecguru84d
Active Exploitation
🚨 UPDATE: CVE-2026-6875 is now confirmed to be actively exploited in the wild. Threat researchers have observed real-world attacks targeting the critical ServiceNow AI Platform sandbox escape vulnerability, with attackers using different exploitation techniques than the originally published PoC. If you're running a self-hosted ServiceNow AI Platform, patch immediately and investigate for signs of compromise. This is no longer just a theoretical risk. 📰 My original analysis: https://thecybersecguru.com/news/servicenow-sandbox-escape-cve-2026-6875/
Post summary
CVE-2026-6875 is actively exploited in real-world attacks targeting the ServiceNow AI Platform sandbox, requiring immediate patching and investigation.
01042452
1.5K followersView on X
Pierluigi Paganini - Security Affairs@securityaffairs84d
Active Exploitation
Attackers Exploit Critical #ServiceNow RCE Flaw CVE-2026-6875 https://securityaffairs.com/195723/ai/attackers-exploit-critical-servicenow-rce-flaw-cve-2026-6875.html #securityaffairs #hacking
Post summary
Attackers are actively exploiting a critical RCE in ServiceNow (CVE-2026-6875), with no indication of patches or PoC details.
03012667
37.7K followersView on X
Misbar | مسبار@MisbarSec84d
Active Exploitation
📌 ثغرة تنفيذ كود حرجة في ServiceNow تُستغل الآن في الهجمات 🛡️ الفئة: ثغرة 📝 الملخص: تم اكتشاف ثغرة (CVE-2026-6875) حرجة في منصة ServiceNow AI، حيث بدأ المهاجمون في استغلالها، وفقًا لما ذكرته شركة الذكاء الإلكتروني Defused. تُتيح هذه الثغرة للمهاجمين تنفيذ كود عن بُعد، مما قد يؤدي إلى اختراق البيانات وسيطرة المهاجمين على الأنظمة. يُؤثر هذا على أنظمة ServiceNow، وقد يتطلب من المنظمات المتأثرة اتخاذ إجراءات سريعة لسد الثغرة. يُنصح بـ تحديث الأنظمة وتطبيق التصحيحات الأمنية المتاحة لمنع المزيد من الهجمات. 🗓️ تاريخ النشر: 20/07/2026 🔗 للمزيد: https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
Post summary
CVE-2026-6875, a remote code execution flaw in ServiceNow AI, is reportedly being actively exploited in attacks, urging organizations to patch promptly.
00051612
406 followersView on X
Jim Nitterauer 🇺🇸@JNitterauer85d
Active Exploitation
CVE-2026-6875, ServiceNow AI Platform pre-auth sandbox-escape RCE, is now being actively exploited. Patch self-hosted instances now if you haven't. #cybersecurity #patchnow https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
Post summary
ServiceNow AI Platform pre‑auth sandbox‑escape RCE (CVE‑2026‑6875) is now being actively exploited; immediate patching urged for self‑hosted instances.
00060511
8.5K followersView on X
The CyberSec Guru@thecybersecguru89d
Patch
🚨 CRITICAL: ServiceNow has fixed CVE-2026-6875, a high-severity AI Platform vulnerability that could allow unauthenticated remote code execution through a server-side sandbox escape. Researchers discovered a novel attack chain involving GlideRecord, JavaScript evaluation, and Script Includes, demonstrating how attackers could break out of the sandbox and potentially gain full control of a ServiceNow instance. While ServiceNow says it has not observed active exploitation, organizations should apply the latest security updates without delay and review the new Guarded Script protections. 🔎 Full technical breakdown, affected versions, timeline, and mitigation: https://thecybersecguru.com/news/servicenow-sandbox-escape-cve-2026-6875/
Post summary
ServiceNow has released a fix for CVE‑2026‑6875, a high‑severity sandbox escape that could enable RCE; organizations are urged to apply updates promptly, and no active exploitation has been observed.
101221.0K
1.5K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-6875

Assetnote[verified]@assetnoteDisclosure

The message announces the discovery of a critical pre-authentication remote code execution vulnerability (CVE-2026-6875) in ServiceNow and links to a detailed research write-up.

ボス@サイバーセキュリティの専門家[verified]@boss_sec_laboActive Exploitation

Multiple CVEs (e.g., CVE‑2026‑59776, CVE‑2026‑0257, CVE‑2026‑6875, etc.) were reported to be actively exploited in the wild, ranging from FeliCa chip tampering to unpatched VPN and RCE vulnerabilities, underscoring a surge in real‑world attacks.

ZoomEye[verified]@zoomeye_teamGeneral

A notification of CVE-2026-6875 affecting ServiceNow AI Platform with exposure details and a link to analysis, but lacking PoC, exploit, or patch information.

kokumօtօ[verified]@__kokumotoActive Exploitation

CVE‑2026‑6875, a ServiceNow sandbox escape RCE, is reported as being exploited in the wild, and a PoC exploit code has already been published.

kokumօtօ[verified]@__kokumotoPatch

CVE‑2026‑6875 is a critical sandbox‑escape vulnerability in ServiceNow with a CVSS v4 score of 9.5, yet no exploitation has been confirmed; however, a patch has been released.

dbugs[verified]@ptdbugsExploit

An exploit‑ready PoC for CVE‑2026‑6875 that enables unauthenticated RCE on ServiceNow AI has been released; no evidence of active exploitation or vendor patches are mentioned.

にゃん☆たく/takumi.a[verified]@taku888infinityPatch

The post reports an RCE vulnerability (CVE-2026-6875) in ServiceNow AI Platform that allows code execution without authentication, and confirms that a patched version is now available.

Vivek | Cybersecurity[verified]@VivekIntelActive Exploitation

The article announces attackers are actively exploiting a critical ServiceNow RCE flaw (CVE-2026-6875). No PoC or exploit code is disclosed, nor is a patch or workaround mentioned.