Loading vulnerability…
Pre-authentication sandbox escape RCE in ServiceNow AI Platform
CVE-2026-6875 is a code-injection and sandbox-escape vulnerability in the ServiceNow AI Platform that permits unauthenticated remote code execution. Pre-authentication application logic passes attacker-controlled values to GlideRecord.addQuery(), where JavaScript-prefixed query values are evaluated inside a restricted filter-script sandbox. The gs.include() mechanism evaluates included scripts in a context without the same restrictions. By manipulating mutable global JavaScript properties used during script inclusion, an attacker can cause attacker-controlled code to be compiled and executed outside the restrictive sandbox. Successful exploitation can compromise the ServiceNow instance and potentially connected MID or proxy servers. Initial claims of a distinct in-the-wild exploit were subsequently corrected when the captured payload was identified as matching the public proof of concept; malicious exploitation is not conclusively established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of a ServiceNow instance by enabling arbitrary table-data access, administrator-account creation, and execution of code through less-restricted internal platform APIs. An attacker may manipulate workflows and business processes and disrupt platform operations. Where MID or proxy servers are configured, exploitation can also enable shell-command execution on those systems, potentially extending compromise into internal enterprise networks. Operating-system root access is not established.
If you can’t patch tonight, do this now.
Enable and verify Guarded Script enforcement to restrict sandboxed execution to a single simple expression, excluding assignments, variable declarations, control flow, function declarations, and multiple statements. On-premises deployments require administrators to advance enforcement phases manually. Until patching is complete, restrict unnecessary network access to the instance and vulnerable pre-authentication functionality. Monitor for suspicious unauthenticated requests, unusual script execution, unexpected administrator creation, abnormal table access, and command activity involving MID or proxy servers. These measures do not replace the vendor patches.
Patch, then assume compromise.
Apply the ServiceNow security updates for CVE-2026-6875 or upgrade to an applicable patched release identified in advisory KB3137947. Listed fixed builds include Australia Patch 2, Zurich Patch 7b or Patch 9, and Yokohama Patch 12 Hot Fix 1b or Patch 13; fixes were also released for Brazil EA and GA. Verify the appropriate release branch, patch, and hot-fix combination with ServiceNow rather than relying on the family name alone. Self-hosted customers and partners must install the supplied updates. Customers using ServiceNow-hosted instances should confirm that the vendor-deployed security update has been applied.
2 exploits validated by Mallory's analysis.
174 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.