cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Defused Says Attackers Are Exploiting ServiceNow CVE-2026-6875

· Original article ↗

Summary

Defused reports in-the-wild exploitation of ServiceNow CVE-2026-6875, a pre-authentication sandbox-escape RCE. ServiceNow says it is not currently aware of exploitation and urges customers to upgrade to patched releases.

Key points

  • CVE-2026-6875 reportedly allows unauthenticated attackers to escape the ServiceNow AI Platform sandbox and execute code remotely.
  • Defused says it observed exploitation beginning after ServiceNow issued patches on July 13.
  • Defused says the attacks reach the same pre-authentication sink described by Searchlight Cyber but use a different route to achieve code execution than the published proof of concept.
  • ServiceNow says it is not currently aware of exploitation against its instances, while advising customers to upgrade to patched releases.
  • ServiceNow patched hosted instances and released updates for self-hosted deployments.

Article Details

Vulnerability Types
  • Pre-authentication sandbox escape enabling remote code execution
Severity
Critical
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Upgrade to a patched release.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers are exploiting CVE-2026-6875 against ServiceNow instances to gain remote code execution.

CVE

CVE-2026-6875ServiceNow · ServiceNow AI PlatformAttackers are actively exploiting CVE-2026-6875, a critical pre-auth sandbox-escape RCE in the ServiceNow AI Platform, using a different route than the published proof of concept.

Vendors

ServiceNowAttackers are actively exploiting CVE-2026-6875, a critical pre-auth sandbox-escape RCE in the ServiceNow AI Platform, using a different route than the published proof of concept.

Products

Now PlatformCVE-2026-6875 affects the ServiceNow AI Platform, formerly known as the Now Platform.ServiceNow AI PlatformAttackers are actively exploiting CVE-2026-6875, a critical pre-auth sandbox-escape RCE in the ServiceNow AI Platform, using a different route than the published proof of concept.

Related Articles