CVE-2026-6875: ServiceNow Pre-Auth RCE Actively Exploited, Patch Now

CVE-2026-6875 is classified as CWE-94 (Improper Control of Generation of Code), a code injection flaw in ServiceNow's script execution sandbox. The ServiceNow AI Platform includes a sandboxed scripting layer that is supposed to isolate custom application code from the underlying host operating system. Under specific conditions, this isolation boundary fails, allowing attacker-controlled input to escape containment and execute directly on the server.

The attack path starts at the /assessment_thanks.do endpoint, a pre-authentication URL reachable by any network-connected client without logging in. Searchlight Cyber's published research identifies this URI as the vulnerable sink where attacker-controlled input reaches the sandbox handling code. A crafted payload sent to this endpoint triggers the escape condition, granting code execution rights within the ServiceNow application context.

Post-exploitation access is extensive. A successful CVE-2026-6875 exploit gives the attacker full access to the ServiceNow instance: ITSM tickets, incident records, change management data, HR workflows, and any credentials or API keys stored in the platform. Proxy servers connected to the ServiceNow instance fall within reach as well. For most organizations, a compromised ServiceNow instance gives the attacker visibility into every operational workflow the platform manages, including integrations with Active Directory, cloud infrastructure providers, and third-party vendors.

Defused confirmed that active in-the-wild attackers use a different sandbox-escape gadget than the one Searchlight Cyber published. This matters operationally: signature-based detection tuned to the public PoC will not catch these attacks. Threat actors invested in independently developing an exploitation path, which indicates higher attacker motivation and a more deliberate campaign than opportunistic scanning.

All four active ServiceNow AI Platform release families contain the vulnerability. Cloud-hosted instances managed by ServiceNow are already patched. Self-hosted, private cloud, and partner-managed deployments must verify and apply patches manually.

The patched versions required per release family are as follows. Brazil family: Brazil EA and Brazil GA are both patched, so any Brazil deployment must confirm it has applied at least one of these builds. Australia: Patch 2 or later. Yokohama: Patch 12 Hot Fix 1b or Patch 13 or later. Zurich: Patch 7b or Patch 9 or later.

Any release version below these thresholds remains vulnerable. ServiceNow advisory KB3137947 provides the authoritative version-to-patch mapping for all families and is the source you should cross-reference against your current deployment version.

The CVSS 4.0 vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The high attack complexity rating (AC:H) reflects that exploitation requires meeting specific technical conditions. Do not treat AC:H as meaningful risk reduction: active exploitation confirmed on July 18 demonstrates that threat actors have met those conditions and are actively scanning for vulnerable instances.

ServiceNow's Guarded Script feature, which restricts executable code in sandbox contexts, serves as a partial mitigation. Organizations that cannot complete patching today should enable Guarded Script immediately as an emergency control, then complete patching under normal change management as soon as the window allows.

Defused threat intelligence confirmed active exploitation attempts against CVE-2026-6875 starting July 18-19, 2026. The five-day gap between patch release and confirmed exploitation matches the pattern seen in previous high-profile enterprise platform CVEs: attackers monitor vendor security advisories, reverse-engineer the fix to reconstruct the vulnerability, and begin scanning for unpatched instances within days of public disclosure.

Searchlight Cyber's Adam Kues stated that in-the-wild attackers exploit via "a different route" than the published PoC, targeting the same /assessment_thanks.do pre-authentication endpoint but using an independent sandbox-escape gadget. This means detection rules tuned specifically to the public PoC payload will miss active attacks.

No specific threat actor group has been formally attributed to this exploitation wave as of July 21, 2026. Prior ServiceNow vulnerabilities including CVE-2024-4879 and CVE-2024-5217 were exploited by ransomware operators and data theft actors within weeks of disclosure. That same threat actor profile is the expected population for CVE-2026-6875, given the value of ServiceNow data and the confirmed large number of self-hosted deployments globally.

Organizations should treat any unexpected process spawning from the ServiceNow application server, unusual outbound connections from ServiceNow hosts, and unexplained changes to ServiceNow administrator accounts as active compromise indicators pending investigation. This follows the same threat pattern documented in the ServiceNow sandbox escape exploitation that followed the SonicWall SMA1000 zero-day and SharePoint RCE CVE-2026-45659 campaigns earlier this month.

No CVE-2026-6875-specific Sigma detection rule exists in the SigmaHQ community repository yet. This is expected for a vulnerability disclosed July 13 and actively exploited as of this week. Dedicated CVE-specific rules typically arrive one to four weeks after active exploitation is confirmed.

Until a dedicated rule ships, two behavioral rules provide the strongest available coverage for ServiceNow RCE post-exploitation. ServiceNow runs on a Java application server. On Windows-hosted deployments, successful CVE-2026-6875 exploitation and subsequent attacker activity produces java.exe spawning unusual child processes: shells, enumeration utilities, or lateral movement tools. The "Suspicious Processes Spawned by Java.EXE" rule fires on this behavior and directly covers post-exploitation on Windows ServiceNow deployments. Deploy it to endpoint detection logs on any Windows host running ServiceNow.

The second rule, "Windows Webshell Strings," targets web server access logs. Attackers executing commands via the sandbox-escape endpoint produce characteristic URL query string patterns in ServiceNow's access logs that match the GET-based command injection signatures this rule detects. Point this rule at your web application or reverse proxy access logs for the ServiceNow host.

Patch remediation for CVE-2026-6875 requires upgrading to a fixed release version per your ServiceNow release family. ServiceNow advisory KB3137947 is the authoritative source for all version-specific patch instructions. For organizations that cannot complete the upgrade today, enabling the Guarded Script feature is a documented temporary mitigation that reduces exploitability.

The six steps below apply to self-hosted, private cloud, and partner-managed ServiceNow deployments. Cloud-hosted instances managed by ServiceNow directly are already patched and require no action.

Enterprise service management platforms are not commonly treated as primary attack targets in the same category as firewalls or identity providers. CVE-2026-6875 demonstrates why that assumption is operationally dangerous. ServiceNow holds a category of operational data that spans the entire IT and business workflow layer of the organizations it serves: every IT incident ticket, every privileged change request, every HR workflow containing employee records, and every API integration credential stored in the platform.

A fully compromised ServiceNow instance gives an attacker an operational map of the target organization more comprehensive than most network reconnaissance tools produce. Change management records reveal infrastructure topology and documented vulnerabilities. Incident tickets describe unresolved security findings. HR workflows contain employee PII. Service account credentials stored in ServiceNow extend attacker reach to every downstream system the platform integrates with, including Active Directory, cloud infrastructure platforms, and third-party vendors.

Prior ServiceNow vulnerability exploitation, including the 2024-2025 campaign targeting CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217, showed that ransomware operators and data theft actors prioritized unpatched ServiceNow instances specifically for this data value. Those attacks used ServiceNow's native scripting mechanisms to establish persistence that survived standard incident response procedures.

The ITSM platform attack surface is real and actively targeted. Treat self-hosted ServiceNow instances below the patched threshold as exposed to a confirmed active exploitation campaign. Patching is the only complete remediation. Start the upgrade process today.