CVE-2026-6875: ServiceNow Pre-Auth RCE Exploited in 5 Days -- Patch Self-Hosted Instances Now

CVE-2026-6875 exploits the intersection of two architectural decisions in the ServiceNow AI Platform: a JavaScript evaluation engine reachable by unauthenticated users, and a sandbox whose isolation can be broken via a script-loading gadget.

ServiceNow's query-filter system lets workflow operators define conditions as JavaScript expressions. That engine evaluates attacker-controlled text as JavaScript when it processes certain pre-authentication HTTP requests. The /assessment_thanks.do endpoint is the primary confirmed attack surface: it accepts POST requests without requiring any authentication token, and the server-side logic routes parameters directly into the JavaScript evaluator without sanitization.

Inside the initial JavaScript sandbox, attacker code is isolated from the underlying Java application server. The sandbox-escape step chains a second primitive: a script-loading call that invokes code in an execution context outside the sandbox boundary. Once the gadget executes, the attacker has code running with ServiceNow platform privileges -- the functional equivalent of direct administrator access to the instance. Searchlight Cyber published a technical description of the first gadget chain in early July. Defused then confirmed a second independent gadget chain reaching the same code-execution primitive via a different route, bypassing detection logic tuned specifically to the original proof-of-concept.

The scope of impact extends well beyond the ServiceNow instance itself. A successful exploit gives the attacker the ability to read and write all configuration data, extract credentials stored in integration profiles, enumerate connected systems and APIs, and pivot into any network segment accessible to the ServiceNow server. Enterprise ServiceNow deployments typically integrate with Active Directory, HR systems, financial platforms, and internal REST APIs -- making platform-level RCE a high-value initial access vector for data exfiltration or lateral movement into the broader enterprise.

From a MITRE ATT&CK perspective, the exploit maps to T1190 (Exploit Public-Facing Application), followed by T1059.007 (JavaScript) for the sandboxed execution step, and T1134 (Access Token Manipulation) for privilege escalation to platform administrator.

CVE-2026-6875 affects self-hosted deployments of ServiceNow AI Platform running versions prior to the patches released in June and July 2026. Cloud-hosted (ServiceNow-managed) instances received an emergency patch on April 5, 2026 -- the day after Searchlight Cyber's responsible disclosure.

The following self-hosted release lines required patching per ServiceNow's advisory KB3137947:

• Brazil EA and Brazil GA
• Australia Patch 2
• Zurich Patch 7b and Patch 9
• Yokohama Patch 12 Hot Fix 1b and Patch 13

ServiceNow deployed its "Guarded Script" mitigation across all versions as part of the April 2026 patch. Guarded Script restricts which JavaScript execution contexts within the platform can invoke script-loading APIs, blocking the primary gadget chain used in the April-through-June timeframe. The July 13 update for self-hosted instances extends this mitigation and addresses additional gadget paths discovered by independent researchers after the initial patch deployed.

Organizations running self-hosted instances on release lines not listed above should verify their specific version's patch status in the ServiceNow Security Response Center. Instances that cannot be patched immediately should be isolated from external network access and placed behind an authenticated reverse proxy to eliminate the pre-authentication attack surface.

Run two verification checks now: (1) confirm your instance build version in System Diagnostics under the Admin menu and compare it against the patched versions listed in KB3137947; (2) review upgrade logs for any automated updates applied since July 13. For cloud-hosted instances, the April 2026 patch is confirmed -- verify in the ServiceNow Customer Success Center under Upgrade History.

The CVE-2026-6875 timeline from vulnerability disclosure to active exploitation illustrates a pattern that repeats across enterprise software vulnerabilities: the gap between patch availability and full deployment at customer sites is the exploitation window attackers target.

April 1, 2026: Searchlight Cyber disclosed CVE-2026-6875 to ServiceNow after responsible disclosure reporting in early April. ServiceNow pushed an emergency patch to all cloud-hosted instances the same day.

April 5, 2026: ServiceNow confirmed cloud-hosted instance patching was complete across all managed environments.

July 13, 2026: ServiceNow published KB3137947 and released patches for self-hosted customer deployments across all affected release lines. Vulnerability details became public knowledge simultaneously -- triggering the countdown to exploitation.

July 18, 2026: Defused security researchers confirmed the first active in-the-wild exploitation attempts targeting the /assessment_thanks.do endpoint on self-hosted instances. The time from patch release to confirmed exploitation: five days. Defused further confirmed attackers used a second sandbox-escape gadget chain not identical to the published Searchlight Cyber proof-of-concept, indicating independent attacker research or prior knowledge of the vulnerability.

Week of July 27, 2026: BleepingComputer and multiple threat intelligence vendors reported ongoing exploitation targeting organizations that had not yet applied the patch.

The five-day exploitation window is faster than most enterprise patch cycles. Internal change management, testing, and maintenance windows routinely extend self-hosted software patching timelines to one to three weeks. For CVE-2026-6875, that standard cycle means most self-hosted organizations are still unpatched while active exploitation is ongoing. Review your emergency patch decision playbook for how to compress this window for Critical vulnerabilities with confirmed in-the-wild exploitation.

No CVE-2026-6875-specific Sigma detection rule exists in the SigmaHQ library as of July 28, 2026 -- expected for a vulnerability actively exploited within the last two weeks. The two rules below target post-exploitation behavior: webshell tunneling and web-based command execution detectable in ServiceNow web access logs.

Deploy both rules against your web access logs (IIS, Apache, Nginx, or ServiceNow's own request logs). The first rule detects ReGeorg-class webshell tunneling behavior via URI query patterns combined with absent referrer and user agent headers. The second catches common command strings used to interact with deployed webshells via GET requests.

Priority log sources to collect: ServiceNow application access logs, web server access logs, and network flow records for the ServiceNow host. If your ServiceNow instance forwards logs to a SIEM, create an alert on POST requests to /assessment_thanks.do from external source IPs. Any such request from an IP not associated with a known integration partner warrants immediate investigation.

The WAF rules below target the exploit entry point directly. Deploy in detection (Count or Log) mode first to baseline traffic, then move to block mode after confirming no false positives from legitimate ServiceNow integrations. The ModSecurity rule uses OWASP CRS-compatible SecRule syntax and rate-limits POST requests to /assessment_thanks.do from external IPs.

No confirmed attacker-controlled infrastructure -- C2 IPs, domains, or file hashes -- for CVE-2026-6875 has been publicly disclosed as of July 28, 2026. The primary attack surface indicator is the pre-authentication endpoint itself, combined with behavioral anomalies on the application server.

Monitor your web access logs for the following patterns:

• POST requests to /assessment_thanks.do from any external source IP without a valid authenticated session cookie
• HTTP 200 responses to POST requests to /assessment_thanks.do from source IPs not associated with known ServiceNow integrations
• Unusual process spawning from the ServiceNow application server process (java.exe or the Tomcat service) -- a sign that code execution has occurred
• New JSP or script files created in ServiceNow application directories after July 13, 2026

ServiceNow logs POST request details in its application access log (accessible via syslog.do for cloud instances; on disk for self-hosted). Filter for requests to /assessment_thanks.do from non-internal IP ranges. Any POST that returns HTTP 200 from an unauthenticated session is anomalous given the endpoint's design.

For self-hosted instances running on Windows, check Windows Event Log ID 4688 for new child processes spawned by the ServiceNow Java process after July 13. Any instance of cmd.exe, powershell.exe, or net.exe as a child of the ServiceNow JVM process indicates confirmed exploitation requiring immediate incident response. For context on scoping a potential compromise, review our analysis of past ServiceNow security incidents.

Self-hosted instances require a direct upgrade to a patched release version. Cloud-hosted instances (ServiceNow-managed SaaS) were patched in April 2026 and need no action beyond status verification. The patch itself requires a maintenance window; schedule one today if you have not already. Verification takes two minutes and should happen before the maintenance window is scheduled.

CVE-2026-6875 earns same-day patch treatment for three reasons: confirmed active exploitation, zero authentication required, and the breadth of connected data accessible from a compromised ServiceNow instance.

The pre-authentication attack surface is the defining risk factor. Most critical enterprise vulnerabilities require at least a low-privileged account to exploit. CVE-2026-6875 requires nothing -- no credentials, no session token, no prior reconnaissance beyond identifying the target instance. Any attacker who can reach your ServiceNow instance's HTTP port can attempt exploitation. Internet-exposed self-hosted instances face this threat from the entire internet; network-internal-only instances face it from any attacker who has achieved perimeter access.

The data exposure multiplies the business impact. Enterprise ServiceNow deployments integrate with virtually every major internal system: Active Directory and LDAP for identity, asset inventory databases, HR systems for employee records, financial platforms via ERP integrations, and custom internal APIs via REST connections. Platform-level code execution gives an attacker read-write access to anything ServiceNow can reach through its integration layer. For organizations managing security operations on ServiceNow, a compromised instance also exposes ongoing incident investigations, detection logic, vulnerability tracking, and threat intelligence data.

The five-day exploitation timeline removes the option of waiting for a standard scheduled maintenance window. Attackers moved to active exploitation before most enterprise patch cycles can complete. If your organization has not patched and your instance has had any external internet exposure since July 13, treat this as a potential compromise investigation, not just a patching task. Run the IOC checks in the previous section alongside applying KB3137947 -- the two actions together are the correct response to an actively exploited critical pre-auth RCE.