Attackers Exploit CVE-2026-6875 in ServiceNow AI Platforms

Threat actors are actively exploiting CVE-2026-6875, a critical code injection vulnerability in the ServiceNow AI Platform. According to recent tracking by cybersecurity firm Defused, active abuse began on July 17, 2026. The vulnerability carries a CVSS v4.0 score of 9.5 and grants unauthenticated attackers full remote code execution on targeted systems.

ServiceNow patched its hosted cloud infrastructure shortly after the initial vulnerability report on April 1, 2026. Self-hosted and on-premises customers did not receive security updates until July 13. This delay created a wide exposure window for enterprise instances operating outside the managed cloud boundary.

Sandbox Escape Mechanics

The vulnerability allows attackers to escape the ServiceNow script sandbox. By targeting the pre-authentication /assessment_thanks.do endpoint, malicious payloads bypass standard access controls to execute arbitrary code on the underlying instance and connected proxy servers.

While security researcher Adam Kues published a specific proof-of-concept demonstrating one path to execution, attackers have adapted quickly. Current in-the-wild exploitation relies on a different sandbox-escape gadget to achieve the same execution primitive. This mirrors complex attack patterns seen in other recent AI exploit chains, where threat actors modify execution paths immediately following public disclosure to bypass preliminary detection rules.

Incident and Remediation Timeline

Event	Date	Status
Initial Discovery	April 1, 2026	Reported by Searchlight Cyber
Cloud Remediation	April 2, 2026	Hosted instances patched silently
Public Disclosure	July 13, 2026	Patch released for on-premises deployments
Active Exploitation	July 17, 2026	First observed by Defused in the wild

Guarded Script and Enterprise Risk

The July 13 security updates introduce a new feature called Guarded Script. This mechanism restricts arbitrary code execution within the sandbox environment to prevent similar escape techniques in the future.

Compromised instances expose organizations to severe operational risks. Because the platform underpins critical enterprise workflows, attackers who achieve execution can establish persistence, move laterally across internal networks, and harvest credentials. Deploying autonomous tooling on these networks requires strict isolation protocols, similar to the ephemeral virtual machines outlined in modern agentic security guides.

If you manage on-premises or self-hosted ServiceNow deployments, you must apply the KB3137947 update immediately. You should also audit proxy server logs for unusual activity targeting the /assessment_thanks.do endpoint between April 1 and your patching date.