Executive Summary
A critical unauthenticated remote code execution (RCE) vulnerability, CVE-2026-6875, has been identified in the ServiceNow AI Platform (formerly Now Platform). This flaw enables unauthenticated attackers to escape the ServiceNow sandbox and execute arbitrary code remotely, posing a severe risk to organizations leveraging ServiceNow for workflow automation and IT service management. The vulnerability is being actively exploited in the wild, with exploitation confirmed by independent security researchers within days of the vendor’s patch release. Given ServiceNow’s prevalence in Fortune 500 enterprises and critical infrastructure, the potential for data exfiltration, service disruption, and lateral movement is significant. Immediate patching and vigilant monitoring are strongly advised.
Threat Actor Profile
Current intelligence indicates that both opportunistic and targeted threat actors are exploiting CVE-2026-6875. While no specific advanced persistent threat (APT) group attribution has been made public, the rapid adaptation of exploitation techniques and the targeting of high-value ServiceNow environments suggest involvement from both cybercriminals and potentially state-sponsored actors. Discussions regarding exploitation methods have been observed in private threat intelligence circles and semi-public forums, indicating a growing interest among sophisticated adversaries. The lack of a public proof-of-concept (PoC) has not deterred attackers, who have demonstrated the capability to reverse-engineer patches and develop bespoke payloads for exploitation.
Technical Analysis of Malware/TTPs
The vulnerability, CVE-2026-6875, is classified as an unauthenticated remote code execution via sandbox escape. Attackers exploit the flaw by sending crafted HTTP requests to the /assessment_thanks.do endpoint of vulnerable ServiceNow instances. The exploitation path observed in the wild diverges from the original PoC published by Searchlight Cyber, demonstrating rapid attacker innovation and adaptation.
The technical root cause lies in improper sandbox isolation within the ServiceNow AI Platform. By leveraging a sandbox escape gadget, attackers can execute arbitrary code on the underlying server, bypassing authentication controls. The attack is initiated pre-authentication, meaning no valid credentials are required, and can be executed remotely over the internet.
Observed tactics, techniques, and procedures (TTPs) include reconnaissance of exposed ServiceNow endpoints, delivery of malicious payloads via crafted HTTP requests, and post-exploitation activities such as privilege escalation, credential harvesting, and lateral movement within the victim’s network. Attackers have demonstrated the ability to adapt their payloads to evade detection and exploit the vulnerability through alternative code paths not originally documented in public advisories.
Indicators of compromise (IOCs) associated with this campaign include anomalous requests to /assessment_thanks.do, unexpected process creation on ServiceNow servers, and evidence of unauthorized data access or exfiltration. Security teams should monitor for these artifacts in server logs and network traffic.
Exploitation in the Wild
Exploitation of CVE-2026-6875 was first observed on July 19, 2026, by Defused security researchers, mere days after the release of the official ServiceNow patch. Attackers have been observed targeting both self-hosted and previously unpatched hosted ServiceNow instances. While no public exploit code has been released, exploitation details and payloads are being actively discussed in private and semi-public threat intelligence communities.
The attack surface is significant, as ServiceNow is widely deployed across industries and geographies. Exploitation is opportunistic, with attackers scanning for vulnerable instances and deploying payloads at scale. The rapid weaponization of this vulnerability underscores the importance of timely patch management and proactive threat hunting.
Victimology and Targeting
Organizations across all sectors utilizing ServiceNow are at risk, with a particular focus on large enterprises in technology, finance, healthcare, and government. The global footprint of ServiceNow means that organizations in North America, Europe, and Asia are especially exposed. Attackers are prioritizing self-hosted ServiceNow AI Platform instances that have not yet applied the July 13, 2026, security update, as these remain vulnerable to exploitation.
Victims identified to date include Fortune 500 companies, critical infrastructure providers, and public sector organizations. The targeting appears to be both broad and deep, with attackers seeking to maximize impact by compromising high-value environments and leveraging access for further intrusion or monetization.
Mitigation and Countermeasures
Immediate action is required to mitigate the risk posed by CVE-2026-6875. Organizations should apply the July 13, 2026, ServiceNow security update to all self-hosted instances without delay. Hosted ServiceNow environments have been patched by the vendor, but verification is recommended.
Security teams should monitor logs for suspicious activity targeting the /assessment_thanks.do endpoint and other ServiceNow interfaces. Anomalous requests, unexpected process execution, and unexplained data access should be investigated promptly. Restricting public exposure of ServiceNow instances, implementing network segmentation, and enforcing least privilege access controls will reduce the attack surface.
In the event of suspected exploitation, affected systems should be isolated, and a comprehensive forensic investigation should be conducted to assess the scope of compromise and remediate any persistence mechanisms established by attackers.
References
- BleepingComputer: Critical ServiceNow code execution flaw now exploited in attacks
- Searchlight Cyber: Vulnerability Discovery and PoC
- Defused Security Researchers
About Rescana
Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their digital supply chain. Our advanced analytics and continuous monitoring capabilities empower security teams to identify vulnerabilities, prioritize remediation, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization’s critical assets, please contact us at info@rescana.com.
