Critical ServiceNow Vulnerability Under Active Exploitation, Researchers Warn
2026-07-27 05:48:39
Cybersecurity researchers are warning that a critical vulnerability affecting the ServiceNow AI Platform is now being actively exploited, allowing unauthenticated attackers to bypass the platform's script sandbox and execute malicious code on vulnerable systems.
The flaw, tracked as CVE-2026-6875, represents a high-risk pre-authentication vulnerability that could enable attackers to compromise ServiceNow instances without requiring valid user credentials.
Pre-Authentication Sandbox Escape
The vulnerability was discovered by researchers at Searchlight Cyber's Assetnote and reported to ServiceNow on April 1, 2026.
According to the researchers, attacker-controlled input can reach a server-side GlideRecord query, triggering unintended JavaScript execution. The vulnerable code path reportedly involves the /assessment_thanks.do endpoint, which can be abused to escape the platform's scripting sandbox.
Because the vulnerability can be exploited before authentication, internet-facing ServiceNow deployments are considered particularly exposed.
Potential Impact
Successful exploitation could allow attackers to execute code within the ServiceNow environment and perform a wide range of malicious actions.
Researchers warn that attackers may be able to:
Execute arbitrary server-side code.
Access sensitive data stored within the ServiceNow platform.
Create new administrative accounts.
Abuse configured MID Servers or proxy infrastructure to execute commands on connected systems.
Establish persistent access for future attacks.
The vulnerability therefore presents a significant risk for organizations relying on ServiceNow to manage IT operations, workflows, and enterprise services.
Active Exploitation Confirmed
While ServiceNow initially stated that it was unaware of active exploitation, threat intelligence company Defused later reported observing exploitation attempts shortly after public disclosure of the vulnerability.
The confirmation of in-the-wild attacks significantly increases the urgency for organizations to deploy available security updates.
Security experts recommend treating CVE-2026-6875 as a high-priority vulnerability due to both its pre-authentication nature and confirmed exploitation activity.
Security Updates Available
ServiceNow has released security updates addressing the vulnerability.
The company has already deployed patches to its hosted cloud instances, while customers operating self-managed ServiceNow environments are advised to upgrade to the latest supported release immediately.
ServiceNow also recommends enabling Guarded Script, a security feature designed to reduce the risk of sandbox escape attacks by restricting potentially dangerous JavaScript operations.
These protections limit the execution of constructs such as variable declarations, control flow statements, assignments, function declarations, and other complex scripting operations within sandboxed environments.
Detection and Mitigation
Organizations should immediately review the status of their ServiceNow deployments and implement the latest available security updates.
Security teams are also encouraged to:
Review logs for requests targeting the /assessment_thanks.do endpoint.
Monitor suspicious use of the sysparm_assessable_type parameter.
Investigate unexpected administrative account creation.
Look for abnormal server-side scripting activity.
Monitor MID Server communications for unusual behavior.
Early detection of suspicious activity may help identify exploitation attempts before attackers establish persistence.
Security Takeaway
The discovery of CVE-2026-6875 highlights the dangers of exposing server-side scripting functionality to untrusted input, particularly in enterprise platforms that process sensitive business data.
With active exploitation now confirmed, organizations using self-managed ServiceNow deployments should prioritize patching and continuously monitor their environments for indicators of compromise to reduce the risk of unauthorized access and code execution.
The flaw, tracked as CVE-2026-6875, represents a high-risk pre-authentication vulnerability that could enable attackers to compromise ServiceNow instances without requiring valid user credentials.
Pre-Authentication Sandbox Escape
The vulnerability was discovered by researchers at Searchlight Cyber's Assetnote and reported to ServiceNow on April 1, 2026.
According to the researchers, attacker-controlled input can reach a server-side GlideRecord query, triggering unintended JavaScript execution. The vulnerable code path reportedly involves the /assessment_thanks.do endpoint, which can be abused to escape the platform's scripting sandbox.
Because the vulnerability can be exploited before authentication, internet-facing ServiceNow deployments are considered particularly exposed.
Potential Impact
Successful exploitation could allow attackers to execute code within the ServiceNow environment and perform a wide range of malicious actions.
Researchers warn that attackers may be able to:
Execute arbitrary server-side code.
Access sensitive data stored within the ServiceNow platform.
Create new administrative accounts.
Abuse configured MID Servers or proxy infrastructure to execute commands on connected systems.
Establish persistent access for future attacks.
The vulnerability therefore presents a significant risk for organizations relying on ServiceNow to manage IT operations, workflows, and enterprise services.
Active Exploitation Confirmed
While ServiceNow initially stated that it was unaware of active exploitation, threat intelligence company Defused later reported observing exploitation attempts shortly after public disclosure of the vulnerability.
The confirmation of in-the-wild attacks significantly increases the urgency for organizations to deploy available security updates.
Security experts recommend treating CVE-2026-6875 as a high-priority vulnerability due to both its pre-authentication nature and confirmed exploitation activity.
Security Updates Available
ServiceNow has released security updates addressing the vulnerability.
The company has already deployed patches to its hosted cloud instances, while customers operating self-managed ServiceNow environments are advised to upgrade to the latest supported release immediately.
ServiceNow also recommends enabling Guarded Script, a security feature designed to reduce the risk of sandbox escape attacks by restricting potentially dangerous JavaScript operations.
These protections limit the execution of constructs such as variable declarations, control flow statements, assignments, function declarations, and other complex scripting operations within sandboxed environments.
Detection and Mitigation
Organizations should immediately review the status of their ServiceNow deployments and implement the latest available security updates.
Security teams are also encouraged to:
Review logs for requests targeting the /assessment_thanks.do endpoint.
Monitor suspicious use of the sysparm_assessable_type parameter.
Investigate unexpected administrative account creation.
Look for abnormal server-side scripting activity.
Monitor MID Server communications for unusual behavior.
Early detection of suspicious activity may help identify exploitation attempts before attackers establish persistence.
Security Takeaway
The discovery of CVE-2026-6875 highlights the dangers of exposing server-side scripting functionality to untrusted input, particularly in enterprise platforms that process sensitive business data.
With active exploitation now confirmed, organizations using self-managed ServiceNow deployments should prioritize patching and continuously monitor their environments for indicators of compromise to reduce the risk of unauthorized access and code execution.