CVE-2026-6875: ServiceNow AI Platform Sandbox-Escape RCE Exploited in the Wild, CVSS 9.5

CVE-2026-6875 is a pre-auth sandbox-escape RCE in ServiceNow AI Platform (CVSS 9.5). Unauthenticated attackers can escape the script sandbox via /assessment_thanks.do and execute code with platform privileges; in-the-wild use was confirmed five days after disclosure.

On 13 July 2026, ServiceNow publicly disclosed a pre-auth remote code execution flaw in its AI Platform, CVE-2026-6875, CVSS 9.5 (Critical). The bug is in `/assessment_thanks.do`. An unauthenticated attacker can trigger a server-side script sandbox escape with a crafted HTTP POST and execute arbitrary code with platform admin privileges. Five days later (18 July), threat intel firm Defused confirmed in-the-wild exploitation. The exploit chain differed from the public PoC and bypassed PoC-tuned IDS signatures. Self-hosted (on-premises) ServiceNow customers face the same urgency.

1. Incident Overview

ServiceNow is one of the largest enterprise workflow and ITSM platforms. An estimated 85% of Fortune 500 companies use it. It hosts ITSM, HRSD, CSM, SecOps, and Now Assist / AI Agent Studio agentic AI, processing more than 100 billion workflows a year. This vulnerability breaks the ServiceNow server-side script sandbox trust boundary. It affects all unpatched self-hosted customers and partner-hosted environments. ServiceNow SaaS customers are covered by ServiceNow and were patched in the cloud in early April.

• CVE: CVE-2026-6875 (ServiceNow KB3137947)
• CVSS: 9.5 (Critical, CVSS v4.0)
• Affected product: ServiceNow AI Platform (including ITSM, CSM, HRSD, SecOps, Now Assist, Agent Studio)
• Affected versions: all self-hosted branches older than the fixed versions below
• Fixed versions: Brazil EA/GA, Australia Patch 2, Zurich Patch 7b or 9, Yokohama Patch 12 Hot Fix 1b or 13
• Discoverer: Searchlight Cyber (responsible disclosure on 1 April)
• Public disclosure: 2026-07-13 / first confirmed in-the-wild: 2026-07-17 to 2026-07-19

2. Technical Details

The bug breaks the ServiceNow AI Platform script sandbox at the intersection of two architecture decisions:

• Unauthenticated JavaScript evaluation engine: ServiceNow query-filter operators let workflow operators define conditions as JavaScript expressions. For some pre-auth HTTP requests, the engine evaluates user input as JavaScript.
• Sandbox boundary broken by a script-loading gadget: `/assessment_thanks.do` accepts POST requests with no identity token. Server-side logic feeds parameters into the JavaScript evaluator without sanitization. After entering the initial sandbox, an attacker uses a script-loading gadget to jump execution from inside the sandbox to outside it and obtain ServiceNow platform privileges—functionally equivalent to full admin access on the instance.

Searchlight Cyber published the first gadget chain in early July. Defused later observed in-the-wild attacks using a second, different gadget chain that bypassed detections tuned to the original PoC. That indicates independent research or rapid variant development. EPSS currently predicts about 24.5% exploitation probability within 30 days, higher than 98% of all CVEs, consistent with observed in-the-wild use.

3. Impact Assessment

Impact exceeds a typical RCE:

• Trust root collapse: the script sandbox is the core trust boundary between low-privilege scripts, user scripts, and agentic AI scripts in a ServiceNow instance. Escaping it equals highest platform privileges.
• Broad lateral movement: ServiceNow is deeply integrated with enterprise IdP, HR data, ticketing, IT infrastructure, and downstream MID Servers. A compromised instance lets attackers move laterally over trusted channels into otherwise isolated core systems.
• Very low exploit bar: no credentials, no phishing, no initial foothold. One HTTP POST starts the chain.
• Short exploit window: public disclosure on 13 July, first confirmed in-the-wild on 18 July—five days. Against ServiceNow's three-month fix window, many unpatched self-hosted instances were already exposed.

CISA had not added CVE-2026-6875 to the KEV catalog as of early August. The Canadian Centre for Cyber Security issued advisory AV26-693. Multiple threat intel vendors marked it urgent.

4. Remediation

4.1 Immediate Fix

Self-hosted customers must upgrade the current branch to one of:

• Brazil: EA or GA
• Australia: Patch 2
• Zurich: Patch 7b or Patch 9
• Yokohama: Patch 12 Hot Fix 1b or Patch 13

After upgrade, verify `Build name` and `Build date` under System Diagnostics → Stats in the ServiceNow console against the patch baseline. SaaS customers need no action. ServiceNow covers them.

4.2 Temporary Mitigations (during the upgrade window)

• Enable strict script sandbox: `glide.script.use.sandbox = true`. ServiceNow docs mark this as one-way (irreversible). Validate business script compatibility in a test environment first.
• On the edge WAF/reverse proxy, restrict `/assessment_thanks.do` to trusted clients. Block unauthenticated external traffic.
• Review ServiceNow access logs for abnormal POSTs to `/assessment_thanks.do`, suspicious JavaScript expressions, or unusual script include calls. Ban matching source IPs immediately.
• Check MID Server configs and session logs on instances unpatched since April for suspicious outbound connections.

4.3 Hardening

• Subscribe to ServiceNow patches. Evaluate and upgrade critical KBs within 72 hours.
• Inventory systems integrated through ServiceNow. Rotate integration credentials.
• Enable instance-level change audit and script execution alerts in ServiceNow.
• Watch ServiceNow follow-on advisories. The first PoC is public. Attackers can still bypass detections with different gadget variants. Defense in depth is required.

5. References

• ServiceNow KB3137947: https://support.servicenow.com/kb?id=kb_article_viewsysparm_article=KB3137947
• Arctic Wolf advisory: https://arcticwolf.com/resources/blog/cve-2026-6875
• Cloud Security Alliance research note: https://labs.cloudsecurityalliance.org/research/csa-research-note-servicenow-ai-platform-sandbox-escape-2026
• Decryption Digest technical analysis: https://www.decryptiondigest.com/blog/servicenow-cve-2026-6875-pre-auth-rce-exploit-patch