Urgent Warning Issued as Critical ServiceNow Platform Flaw, CVE-2026-6875, Now Under Active Exploitation by Threat Actors

A severe vulnerability impacting the ServiceNow AI Platform, identified as CVE-2026-6875, is currently being leveraged by malicious actors in real-world attacks, marking a significant escalation in the threat landscape for enterprises relying on this ubiquitous cloud-based service. This critical security defect allows unauthenticated remote code execution, posing an immediate and profound risk to organizations globally.

ServiceNow, a prominent enterprise-grade Platform-as-a-Service (PaaS), underpins essential business operations for a vast array of organizations worldwide. Renowned for its capability to integrate artificial intelligence into core enterprise workflows, the platform (formerly known as the Now Platform) facilitates over 100 billion workflows annually and supports more than 100,000 enterprise AI applications, boasting adoption by 85% of Fortune 500 companies. Its deep integration into critical infrastructure makes any vulnerability, particularly one enabling unauthenticated remote code execution, a matter of paramount concern.

The discovery of this critical flaw is attributed to cybersecurity firm Searchlight Cyber. Their research, publicly detailed on April 1st, revealed the potential for threat actors to bypass the platform’s security sandbox and execute arbitrary code remotely. This "sandbox escape" mechanism, combined with pre-authentication remote code execution (RCE), represents a highly complex and sophisticated attack vector. An unauthenticated RCE vulnerability is among the most severe classifications, as it permits attackers to compromise a system without needing valid credentials, significantly lowering the bar for exploitation and increasing the scope of potential targets. The ability to escape a sandbox further amplifies the danger, as sandboxes are designed to isolate processes and limit the impact of malicious code, acting as a crucial security boundary.

Following the responsible disclosure, ServiceNow promptly addressed the vulnerability. The company rolled out patches for its hosted instances and subsequently released security updates for self-hosted deployments on July 13th. These updates were crucial for mitigating the risk associated with CVE-2026-6875, which has since been cataloged in the National Vulnerability Database, detailing its severe impact.

Despite the timely release of patches, the security landscape quickly deteriorated. Over the recent weekend, threat intelligence company Defused provided concrete evidence that attackers had commenced exploiting CVE-2026-6875 in the wild. Their security researchers confirmed observing initial exploitation attempts on Friday, merely days after ServiceNow had issued the necessary updates. This swift transition from patch availability to active exploitation underscores the urgency with which sophisticated threat actors monitor and react to public vulnerability disclosures.

Defused communicated their findings via social media, stating, "We are observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875)." Their analysis further elaborated on the technical nuances of the observed attacks, noting that while the payloads targeted the same pre-authentication entry point documented by Searchlight Cyber (specifically, /assessment_thanks.do), the methodology for achieving the sandbox escape differed from the publicly published proof-of-concept. This indicates that attackers are either independently developing their exploitation techniques or adapting existing knowledge to bypass security measures or exploit variations. The fundamental outcome, however, remains the same: unauthorized code execution.

This development presents a notable divergence from ServiceNow’s official stance. At the time of Defused’s report, ServiceNow’s public advisory still indicated that the company was "not currently aware of exploitation against ServiceNow instances." Such discrepancies between independent threat intelligence and vendor statements are not uncommon, often stemming from differing visibility into attack telemetry, the time required for internal verification, or the nature of the observed attacks (e.g., initial probes versus successful breaches). Nevertheless, the confirmation from a reputable threat intelligence firm like Defused serves as a critical alert for all ServiceNow customers.

The implications of active exploitation are profound. Given ServiceNow’s extensive footprint across critical enterprise functions—from IT service management and customer service to HR and security operations—a successful exploitation of CVE-2026-6875 could lead to catastrophic outcomes. Potential consequences include, but are not limited to, large-scale data breaches compromising sensitive corporate and customer information, complete system compromise, operational disruption, intellectual property theft, and the establishment of persistent backdoors within an organization’s IT infrastructure. For companies relying on self-hosted instances, the imperative to apply patches immediately becomes an existential cybersecurity priority. While ServiceNow manages patching for its cloud-hosted environments, customers still need to verify their instance versions and configurations.

This incident also brings into sharper focus the ongoing challenges in securing complex, AI-driven enterprise platforms. As these platforms become more integrated and intelligent, their attack surface expands, and the potential impact of vulnerabilities increases. The sophistication of an attack involving pre-authentication RCE and sandbox escape highlights the advanced capabilities of modern threat actors and the need for equally advanced defensive strategies.

Organizations leveraging ServiceNow are strongly advised to take immediate and decisive action. The primary recommendation, echoed by ServiceNow itself, is to upgrade to a patched release without delay. This is not merely a suggestion but a critical security mandate. Beyond immediate patching, organizations should reinforce their overall cybersecurity posture. This includes implementing robust vulnerability management programs, conducting regular security audits, employing network segmentation to limit lateral movement in the event of a breach, and enhancing monitoring capabilities to detect anomalous activity that might indicate exploitation attempts. Incident response plans should be reviewed and updated to account for potential compromises of critical SaaS/PaaS platforms.

This is not the first security incident to impact ServiceNow recently. Last month, the company privately disclosed a separate security incident involving an unauthenticated access flaw via a vulnerable API endpoint, which exposed customer data. While that incident was ultimately attributed to security researchers and bug bounty submissions rather than malicious actors, it underscores a pattern of security challenges in managing the vast and complex attack surface of a leading enterprise platform. The current active exploitation of CVE-2026-6875 serves as a stark reminder that even the most robust platforms are not immune to highly sophisticated attacks, necessitating continuous vigilance and proactive security measures from both vendors and their customers. The evolving threat landscape for critical enterprise platforms demands an unwavering commitment to security by design and rapid response to emerging threats.