Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution

1. Executive summary

A critical code injection vulnerability (CVE-2026-6875, CVSS 9.5) in the ServiceNow AI Platform is being actively exploited in the wild by unauthenticated attackers to achieve remote code execution via sandbox escape. The flaw enables complete compromise of the affected ServiceNow instance and all connected proxy servers. ServiceNow released patches across multiple release families throughout June 2026; self-hosted customers that have not yet applied these fixes are at immediate risk. EMEA financial services running self-hosted ServiceNow instances should treat this as a P1 remediation.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 24: digital operational resilience testing — general requirements	A CVSS 9.5 unauthenticated RCE with confirmed in-the-wild exploitation in a core workflow platform	Clients must verify that vulnerability scanning and penetration testing programmes would detect CVE-2026-6875 against self-hosted ServiceNow instances and confirm patch coverage as part of resilience testing.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	Active exploitation enabling complete instance compromise and potential data access from a business-critical platform	If exploitation is confirmed on a client instance, assess against major-incident classification criteria and prepare for authority notification timelines.

3. Technical analysis & attack chain

Vulnerability: CVE-2026-6875 — CVSS 9.5 CRITICAL — CWE-94 (Code Injection). Not in CISA KEV. EPSS 1%.

Note on classification: The Hacker News source describes this as a "sandbox escape vulnerability" while the verified NVD record classifies it as CWE-94 (Code Injection). Both classifications describe the same flaw: the attacker injects code that escapes the script sandbox to execute arbitrary code on the underlying instance.

Discovery and disclosure: The vulnerability was reported to ServiceNow by Searchlight Cyber on April 1, 2026. Patches were released by ServiceNow throughout June 2026.

Confirmed attack chain

Initial access — unauthenticated endpoint targeting. The attacker sends an HTTP POST request to the pre-authentication endpoint /assessment_thanks.do. No credentials are required.
Code injection and sandbox escape. The request exploits a code injection flaw in the ServiceNow script sandbox. The sandbox-escape gadget — documented in a proof-of-concept exploit — routes to the same code execution primitive via a different path than the originally disclosed mechanism.
Remote code execution. Arbitrary code executes on the targeted ServiceNow instance with the privileges of the platform runtime.
Complete instance compromise. Searchlight Cyber confirmed the vulnerability allows "a complete compromise of the ServiceNow instance as well as all connected proxy servers."

Affected products and patched versions

ServiceNow AI Platform (self-hosted instances)
Patches released in:
Brazil EA and Brazil GA
Australia Patch 2
Zurich Patch 7b and Zurich Patch 9
Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13

Attribution: No named threat actor has been identified in the source material. Attribution is unconfirmed. The exploitation reporting originates from a single threat intelligence firm (Defused Cyber) via a post on X; this is single-sourced and should be verified before enforcement decisions are finalised.

Related context: A separate, earlier ServiceNow security incident (June 2026) involved exploitation of an unauthenticated access flaw through a vulnerable API endpoint allowing data queries from customer instances. This is a distinct issue from CVE-2026-6875 but indicates sustained targeting of ServiceNow platform weaknesses.

4. Mitigation & containment

P1 — Within 24 hours

Identify all self-hosted ServiceNow instances in the estate. Confirm release family and patch level.
Apply the relevant patch immediately:
Brazil EA / Brazil GA — apply June patch
Australia — apply Patch 2
Zurich — apply Patch 7b or Patch 9
Yokohama — apply Patch 12 Hot Fix 1b or Patch 13
For instances that cannot be patched immediately, restrict network access to /assessment_thanks.do at the reverse proxy / WAF layer. Block HTTP POST requests to this endpoint from untrusted sources.
Review ServiceNow instance and proxy server logs for HTTP POST requests to /assessment_thanks.do from the period April 2026 onward. Flag any anomalous or high-volume activity for incident response.

P2 — Within 72 hours

Confirm that ServiceNow's post-patch sandbox hardening is in effect. ServiceNow is "enhancing instance security by severely restricting the type of code that can run in sandbox contexts" — verify this control is active on patched instances.
Validate that no persistence mechanisms were established on instances exposed during the vulnerability window. Inspect for unauthorised scripts, scheduled jobs, or configuration changes.
If exploitation is confirmed, initiate incident response and assess against DORA Art. 19 major-incident reporting criteria.

P3 — Within 7 days

Ensure vulnerability management processes include ServiceNow AI Platform as an in-scope asset for ongoing scanning.
Update WAF / IDS signatures to alert on POST requests to /assessment_thanks.do as a detection baseline.
Confirm third-party managed ServiceNow hosting providers have applied patches (engage under DORA Art. 28 / Art. 30 contractual provisions if applicable).

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material.

Behavioural indicators

Behaviour	Where to observe	Confidence
HTTP POST requests to `/assessment_thanks.do` from unauthenticated sessions	ServiceNow instance access logs; reverse proxy / WAF logs; SIEM	High — corroborated across multiple sources
Unauthorised code execution originating from ServiceNow script sandbox context	ServiceNow platform logs; EDR on ServiceNow host (self-hosted)	Medium — consistent with vulnerability mechanism
Unexpected configuration changes, new scripts, or scheduled jobs on ServiceNow instance	ServiceNow audit logs	Medium — indicative of post-exploitation

6. Detection

The primary observable artefact is the endpoint path /assessment_thanks.do targeted via HTTP POST. The following Sigma rule targets this behaviour in web/proxy logs.

title: ServiceNow CVE-2026-6875 - Unauthenticated POST to assessment_thanks.do
id: 7a3c1f2e-2026-0721-0001
status: experimental
description: >
  Detects unauthenticated HTTP POST requests to /assessment_thanks.do,
  consistent with exploitation of CVE-2026-6875 (ServiceNow AI Platform
  sandbox escape / code injection).
author: Adverse Trace
date: 2026/07/21
references:

  - https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html
  - https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
  - https://www.helpnetsecurity.com/2026/07/20/servicenow-cve-2026-6875-exploited/
logsource:
  category: webserver
  product: nginx
  product: apache
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: '/assessment_thanks.do'
  condition: selection
falsepositives:

  - Legitimate assessment workflow submissions (verify against expected user authentication state and source IP reputation)
level: high

No YARA rule is authored. The source material does not contain file-based artefacts (strings, mutex names, file paths, or hard-coded values) attributable to the exploit payload itself.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-6875	9.5 Critical	—	1%	ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerab…

7. Sources

The Hacker News — Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution — https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html — 2026-07-21
BleepingComputer — Critical ServiceNow code execution flaw now exploited in attacks — https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/ — 2026-07
Help Net Security — ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875) — https://www.helpnetsecurity.com/2026/07/20/servicenow-cve-2026-6875-exploited/ — 2026-07-20
BSI Germany (WID) — WID-SEC-2026-2302: ServiceNow AI Platform: Schwachstelle ermöglicht Codeausführung — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2302 — 2026-07
SecurityWeek — Vulnerabilities Patched by Fortinet, Ivanti, ServiceNow — https://www.securityweek.com/vulnerabilities-patched-by-fortinet-ivanti-servicenow/ — 2026-07
BleepingComputer — ServiceNow discloses security incident exposing customer data — https://www.bleepingcomputer.com/news/security/servicenow-discloses-security-incident-exposing-customer-data/ — 2026-06
The Hacker News — ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances — https://thehackernews.com/2026/06/servicenow-flaw-exploited-to-gain.html — 2026-06

8. Adverse Trace position

CVE-2026-6875 is a CVSS 9.5 critical unauthenticated code injection vulnerability with confirmed in-the-wild exploitation, enabling complete compromise of ServiceNow instances and connected proxy servers. The severity is not inflated — the verified NVD CVSS and CWE classifications are used as authoritative. Attribution to any specific threat actor is unconfirmed; the exploitation claim is single-sourced (Defused Cyber via X post) but corroborated by BSI Germany issuing a high-severity advisory and multiple independent security outlets reporting the active exploitation. EMEA financial services clients running self-hosted ServiceNow instances should apply the relevant June patches immediately and conduct retrospective log review for POST traffic to /assessment_thanks.do. Adverse Trace will monitor for additional IOCs, CISA KEV addition, and any confirmed attribution. Clients with ServiceNow-hosted (SaaS) instances should confirm with ServiceNow that patches have been applied to their tenant.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.