ServiceNow CVE-2026-6875: Pre-Auth Sandbox Escape RCE

What to do

1. Confirm whether any instance you run is self-hosted or partner-hosted rather than ServiceNow-hosted
2. Upgrade self-hosted instances to a fixed patch or family release listed in KB3137947
3. Restrict internet access to self-hosted instances (VPN or allow-list) until patched
4. Review MID Server hosts for unexpected commands, since the bug can reach them
5. Rotate credentials stored in the instance if you find signs of exploitation

How to check if you are affected or compromised

• Search web/access logs for requests to /assessment_thanks.do where sysparm_assessable_type or other query values start with javascript:
• Review sys_user for recently created admin accounts and the audit log for unexpected role grants
• Check MID Server hosts for unusual child processes and outbound connections

What happened#

On April 1, 2026, Searchlight Cyber reported a pre-authentication remote code execution bug in the ServiceNow AI Platform, the platform formerly called the Now Platform. ServiceNow mitigated its own hosted instances within 24 hours, and patches for the underlying issues followed. On July 13, ServiceNow published advisory KB3137947 and CVE-2026-6875 for self-hosted customers and partners. The CVE record (CNA: ServiceNow) says the flaw "could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform" and scores it CVSS 4.0 9.5, with attack complexity rated high.

Searchlight's technical write-up followed on July 14. User input reaching a query filter that evaluates a javascript: prefix, first found on /assessment_thanks.do, could be combined with an escape from ServiceNow's script sandbox. Searchlight says the result is unsandboxed JavaScript that can read any table, including stored credentials, create administrator accounts, and run shell commands on connected MID Servers, which often sit inside internal networks.

Within days, threat-intel firm Defused reported in-the-wild exploitation attempts, first seen July 17 and confirmed that weekend, according to BleepingComputer. The Canadian Centre for Cyber Security updated its advisory on July 20 to note open-source reports of exploitation. ServiceNow's position differs: its advisory says it is "not currently aware of exploitation against ServiceNow instances," and a spokesperson told BleepingComputer that it found no evidence the activity relates to instances it hosts. CVE-2026-6875 was not in the CISA KEV catalog as of October 21, 2026.

Who is affected#

According to the CVE record and the Cyber Centre, ServiceNow AI Platform releases are affected before Australia Patch 2, Zurich Patch 7b or Patch 9, Yokohama Patch 12 Hot Fix 1b or Patch 13, and Brazil EA/GA. ServiceNow-hosted instances got the fix months before disclosure. The group still exposed is self-hosted customers and partner-operated instances that haven't applied the July patches.

Do you really need to act?#

If ServiceNow hosts your instance, there is little to do beyond confirming you are on a current patch level, which ServiceNow also recommends. Most can relax.

If you self-host, this is serious. ITSM platforms hold integration credentials for Active Directory, cloud accounts and monitoring tools, and Searchlight shows the bug reaching MID Servers on internal networks. Public technical detail has been available since July 14, and Defused saw attackers using a different sandbox-escape route than Searchlight's proof of concept, so others were working on it independently. The "high complexity" rating is not a safety margin when a working method is published. There is a real disagreement over whether these exploitation attempts succeeded anywhere. A cautious reading is "actively targeted," not "confirmed breaches."

What to do now#

1. Inventory every ServiceNow instance you operate, including dev and sub-prod, and identify which are self-hosted or partner-hosted.
2. Upgrade self-hosted instances to one of the fixed patch or family releases listed in KB3137947.
3. Until patched, put self-hosted instances behind a VPN or IP allow-list rather than exposing them to the internet.
4. Consider ServiceNow's "Guarded Script" hardening (KB2944435), which Searchlight cites as the longer-term mitigation for this class of bug.
5. If you find signs of exploitation, rotate credentials stored in the instance and on MID Servers.

How to tell if you were hit#

• Search web and access logs for requests to /assessment_thanks.do whose parameters, for example sysparm_assessable_type, begin with javascript:. Defused says payloads target this sink.
• Review sys_user for administrator accounts created after April 2026 that you cannot explain, and the system log and audit tables for unexpected role grants or script executions.
• On MID Server hosts, look for unusual child processes of the MID Server service and new outbound connections.

Timeline#

• Apr 1, 2026 — Searchlight reports the flaw; hosted instances mitigated within 24 hours.
• Jul 13, 2026 — ServiceNow publishes KB3137947 and CVE-2026-6875 with self-hosted patches.
• Jul 14, 2026 — Searchlight technical write-up; Canadian Cyber Centre advisory AV26-693.
• Jul 17, 2026 — Defused observes first in-the-wild exploitation attempts.
• Jul 20, 2026 — Cyber Centre updates its advisory to note exploitation reports.

Vulnerability records

• CVE-2026-6875 · ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE.org — CVE-2026-6875 cve.org
2. Canadian Centre for Cyber Security — ServiceNow security advisory (AV26-693) cyber.gc.ca
3. Searchlight Cyber — Smashing the ServiceNow Sandbox: Pre-Authentication RCE slcyber.io

Coverage and analysis

1. BleepingComputer — Critical ServiceNow code execution flaw now exploited in attacks bleepingcomputer.com