Skip to content
hacker_posts

ServiceNow CVE-2026-6875: pre-auth sandbox escape RCE now exploited

ServiceNow's July 13 patch closes CVE-2026-6875 — a pre-auth sandbox escape in the AI Platform that yields unauthenticated RCE. Defused observed in-the-wild exploitation five days later.

Published 4 min read
cveservicenowrceadvisory

ServiceNow released KB3137947 on July 13, 2026 to fix CVE-2026-6875, a pre-authentication sandbox escape in the ServiceNow AI Platform — the rebranded Now Platform — that grants unauthenticated remote code execution on the target instance. CVSS 9.5 Critical. Threat-intel firm Defused observed the first exploitation attempts on Friday, July 18 — five days after the self-hosted patch shipped. The pre-auth sink attackers hit is /assessment_thanks.do, the same endpoint Searchlight Cyber's proof-of-concept documented on disclosure day.

What the bug is

  • CWE: sandbox escape leading to unauthenticated code execution.
  • Entry point: the /assessment_thanks.do endpoint, reachable without authentication on affected AI Platform instances.
  • Primitive: an attacker-crafted payload escapes the ServiceNow scripting sandbox and reaches the same code-execution primitive Searchlight Cyber demonstrated — through a different sandbox-escape gadget than the public PoC.
  • Outcome: full compromise of the ServiceNow instance. Searchlight Cyber researcher Adam Kues told The Hacker News the flaw "allows a complete compromise of the ServiceNow instance as well as all connected proxy servers."

Affected releases

Per ServiceNow's KB, the fixed patches are:

  • Brazil EA and Brazil GA
  • Australia Patch 2
  • Zurich Patch 7b and Zurich Patch 9
  • Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13

The vulnerability was reported by Searchlight Cyber on April 1, 2026. ServiceNow patched hosted (SaaS) tenants over the following weeks and shipped fixes for self-hosted customers on July 13, 2026. Self-hosted instances that have not applied the July release remain vulnerable.

Exploitation status

Confirmed in the wild. Defused posted the observation over the weekend of July 18–19: payloads hitting /assessment_thanks.do matching the pre-auth sink Searchlight Cyber described, escaping the sandbox via a different route than the public PoC to reach the same execution primitive. Bleeping Computer and SecurityWeek both confirmed active exploitation the same weekend.

ServiceNow's own statement, quoted by SecurityWeek, is narrow: the company has "not observed evidence that this activity is related to instances that ServiceNow hosts." That leaves self-hosted deployments — the population that had to patch manually after July 13 — as the exposed surface.

Action checklist

  1. Patch self-hosted AI Platform today. Apply the release train listed in KB3137947 that matches your family (Brazil EA/GA, Australia Patch 2, Zurich 7b/9, or Yokohama 12 HF1b/13). Nothing shorter than a full patch closes the sink.
  2. If you cannot patch immediately, block /assessment_thanks.do at the WAF or reverse proxy. It is the pre-auth entry every observed payload has used. Blocking it will break the legitimate post-assessment landing page, but that is preferable to an RCE.
  3. Hunt for post-exploitation. Public PoC has been out since July 14, and Defused is watching payloads that already escape the sandbox by a novel route — assume triage on any self-hosted instance that faced the internet between July 13 and today.
  4. Check for downstream compromise. Kues's warning that the primitive reaches "all connected proxy servers" means MID Servers, LDAP integrations, and any credential the instance holds are in scope. Rotate service-account secrets that touched the instance before you finished patching.
  5. Hosted tenants: confirm your instance family. ServiceNow says its hosted fleet is not seeing this activity, but a family that never received the April backport would be an outlier worth confirming with the vendor.

Context

CVE-2026-6875 lands three months after ServiceNow's last critical — the Now Assist / string-substitution flaws that let low-privileged users enumerate restricted records — and continues a pattern of pre-authentication endpoints in the platform's scripting surface turning into full-instance RCE. The five-day window from patch to observed exploitation is the story: Searchlight Cyber's disclosure landed alongside the fix, ServiceNow published the KB, and attackers reversed the gadget faster than most self-hosted operators could schedule the maintenance window.

What other outlets missed

Both the Hacker News writeup and ServiceNow's KB describe the exploit as matching Searchlight Cyber's PoC. Defused's observation — surfaced only in the Bleeping and SecurityWeek follow-ups — is that the in-the-wild payload reaches the same code-execution primitive by a different sandbox-escape gadget than the published PoC. That matters for detection: signatures written against the public PoC's escape gadget will miss the payload defenders are actually seeing.

Related stories