CVE-2026-6875: Active Attacks on Self-Hosted ServiceNow; Cloud…

Threat actors are exploiting CVE-2026-6875 against unpatched self-hosted ServiceNow instances. The sandbox escape enables pre-authentication RCE via two distinct gadgets.

Threat actors have begun exploiting CVE-2026-6875 in the wild, a pre-authentication vulnerability in the ServiceNow AI Platform with a CVSS v4.0 score of 9.5 on the CRITICAL scale. The first attempts were detected on July 18, 2026, five days after the release of patch KB3137947 for self-hosted instances. ServiceNow cloud-hosted instances, by contrast, had been protected since April 2026, creating an exposure gap between the two deployment models.

The vulnerability, discovered by Searchlight Cyber and reported to ServiceNow in early April 2026, allows escape from the JavaScript sandbox of the GlideRecord engine to achieve remote code execution equivalent to administrative privileges. Attackers are not merely replicating the published proof-of-concept: Defused has observed payloads with an independent sandbox-escape gadget, indicating autonomous understanding of the flaw.

Key Takeaways

CVE-2026-6875 is a pre-authentication vulnerability with CVSS v4.0 9.5 CRITICAL that enables RCE via escape from the ServiceNow AI Platform JavaScript sandbox.
Active exploitation was confirmed by Defused starting July 18, 2026, with payloads targeting the /assessment_thanks.do endpoint but using a different technical path than the published PoC.
ServiceNow mitigated cloud-hosted instances within 24 hours of the April 2026 report; self-hosted instances remained exposed until July 13, 2026.
Compromise allows command of connected MID Server proxies, typically placed inside the organization's internal network, extending the blast radius beyond the ServiceNow instance.

The Sandbox Escape Mechanism: From gs.include() to Unsandboxed Execution

The core of the flaw lies in how the ServiceNow AI Platform handles the javascript: filter within GlideRecord queries. When this filter is triggered via the sysparm_assessable_type parameter on the /assessment_thanks.do endpoint, the code executes inside a restrictive sandbox: isolated context, limited privileges, apparently harmless.

The critical transition occurs through gs.include(), a function that loads script-include libraries outside the restrictive sandbox. The attacker overrides Object.clone with the Function constructor via Object.defineProperty, an operation that corrupts ServiceNow's class-extension logic. This coercion induces the system to execute Function(attacker_code) in an unsandboxed context, completely bypassing isolation.

In this state, execution equates to administrative access on the Glide platform: read and write access to all tables, creation of accounts with elevated privileges, and command of configured MID Server proxies that communicate with the internal network.

Two Gadgets, Same Primitive: The Evolution of In-the-Wild Attacks

Confirmation of active exploitation comes from Defused, with a characteristic that adds gravity to the threat. According to the source, "the payloads hit the same pre-authentication sink documented by Searchlight Cyber (/assessment_thanks.do), but the sandbox-escape gadget reaches the same code-execution primitive through a different route than their published PoC."

This observation has concrete operational implications. Attackers are not simply replicating public research: they possess independent understanding of the vulnerability, with the capability to develop alternative variants of the exploit mechanism. The attack surface does not narrow to defense against a single documented vector.

"By overriding frozen global objects with Object.defineProperty, an attacker replaces Object.clone with the Function constructor and a class prototype with attacker-controlled code. This coerces ServiceNow's own class-extension logic into calling Function(attacker_code) unsandboxed." — Indusface Technical Analysis

The Cloud/Self-Hosted Divide: Who Controls the Infrastructure

The CVE-2026-6875 timeline highlights a structural dynamic in the enterprise security supply chain. Searchlight Cyber reported the vulnerability in early April 2026. ServiceNow deployed updates for cloud-hosted instances the next day. Patches for self-hosted customers arrived during June, with formal release KB3137947 on July 13, 2026.

The exposure window between the two populations is measurable in months, not days. In-the-wild exploitation opened on July 18, five days after the self-hosted patch became available. According to Indusface, the ServiceNow AI Platform executes approximately 100 billion workflows annually for roughly 85% of the Fortune 500. Massive adoption amplifies systemic risk: every unpatched self-hosted instance represents a potential entry point into an enterprise organization's network.

ServiceNow stated, via a spokesperson, that it has not observed "evidence that this activity is related to instances that ServiceNow hosts directly," and encourages patch application. The statement underscores the division of responsibility: operational security of self-hosted instances falls on the owning organization.

Immediate Actions

Priority actions for organizations with ServiceNow instances are as follows:

Immediately verify application of the July 13, 2026 KB3137947 patch on all self-hosted instances, whether on-premise or partner-hosted.
Check access logs for the /assessment_thanks.do endpoint for suspicious requests with a manipulated sysparm_assessable_type parameter, with particular attention to the July 13-24, 2026 period.
Inspect the configuration and integrity of MID Server proxies connected to ServiceNow instances, verifying any unauthorized modifications to script-includes or system tables.
Evaluate the new "Guarded Script" functionality introduced in the patches, designed to limit executable code in the sandbox, as a structural mitigation against future variants of the mechanism.

Measuring Enterprise Risk

The ServiceNow platform is not a peripheral system: it is infrastructure-as-workflow for the world's largest organizations. Its compromise does not merely expose ticketing data or HR workflows; it provides a bridge to the internal network via the MID Server architecture. Attackers who gain administrative control over ServiceNow potentially acquire visibility and command over network segments otherwise isolated.

The dual nature of the observed exploit — same endpoint, different gadget — suggests the vulnerability has been analyzed by multiple actors independently. This is not replication of a single PoC, but convergence on a shared architectural flaw. For organizations managing self-hosted instances, the July 13 patch is not a routine update: it is containment of a documented active risk.

Frequently Asked Questions

Are ServiceNow cloud-hosted instances at risk?

No. ServiceNow deployed updates for cloud-hosted instances within 24 hours of the April 2026 report. The company states it has not observed exploitation against this population.

Why is the CVSS score 9.5 if the attack requires multiple steps?

The CVSS v4.0 vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H reflects network access without authentication, with complete impact on confidentiality, integrity, and availability of the affected system, including subsystem effects. Attack complexity (AC:H) is present but does not lower severity below the critical threshold.

Is a public exploit available?

Searchlight Cyber published a proof-of-concept and technical post on July 13, 2026. However, active attackers are using an independent gadget, not the published PoC. The presence of a public exploit facilitates replication, but is not a necessary condition for the observed activity.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references