Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026

Attackers are exploiting critical ServiceNow flaw CVE-2026-6875, allowing unauthenticated remote code execution on self-hosted instances.

Searchlight Cyber researchers disclosed a critical pre-authentication remote code execution vulnerability, tracked as CVE-2026-6875, in the ServiceNow AI Platform on July 14. The same day, ServiceNow released patches for self-hosted instances. Since July 17, attackers have started exploiting it in the wild.

“After finding our first pre-auth critical bug almost two years ago and having a much better understanding of the ServiceNow architecture, we decided to return and focus our efforts on a different corner of the codebase.” reads the report published by Searchlight Cyber. “Our efforts led to us finding a completely unauthenticated RCE, which allowed full compromise of the ServiceNow instance as well as all connected proxy servers.”

The entry point is ServiceNow’s GlideRecord query API, which accepts user-supplied data in hundreds of places across the codebase. The twist: by prefixing a value with javascript:, ServiceNow evaluates the string as JavaScript before using it as a query argument, a documented feature that turns every unauthenticated query sink into a potential script execution point.

ServiceNow had anticipated this and added a second sandboxing layer for user-supplied filters, called the script sandbox. It restricts function definitions, blocks eval, limits accessible Java classes, and makes table access read-only for unauthenticated users. Getting anything useful out of the initial injection required escaping that additional layer.

“So within the environment of included functions, there are no restrictions applied. However, within our code, they restrict it heavily. Is there any way we can influence the code being run without restrictions? It turns out, we can! Any function that calls a global function can have its calls overridden.” states the report. “But if we include libraries of functions via gs.include(), we don’t get this error at all. We can trace the Java code responsible for the implementation to ASystemInclude.includeScript:”

The sandbox escape uses this gap: by overriding Object.clone with the Function constructor and setting AbstractAjaxProcessor.prototype to the attacker’s payload, a subsequent gs.include('ItemViewElementsProvider') causes the sandbox to call Function(payload) in an unsandboxed context, returning a callable function that executes arbitrary code.

The reachable pre-auth sink is the endpoint /assessment_thanks.do via the parameter sysparm_assessable_type, which passes user input directly into a GlideRecord query with no sanitization.

“The impact is much the same as our previous bug. With our access to the Rhino engine we can pull any data from any tables we like and create admin users at will.” concludes the report. “We can also run shell commands on any proxy servers configured, which commonly sit within companies’ internal network.”

ServiceNow runs more than 100 billion workflows annually and powers AI applications at 85 percent of Fortune 500 companies. The blast radius here is not small.

Searchlight reported the vulnerability on April 1, 2026. ServiceNow deployed mitigations to cloud instances within 24 hours by blocking modification of key JavaScript functions, then followed up with patches addressing the underlying issues over subsequent weeks. The fix is tracked as CVE-2026-6875.

ServiceNow announced it had strengthened its sandbox security by limiting executable code to a single simple expression. The updated Guarded Script blocks variable declarations, control flow, function definitions, assignments, and multiple statements, making sandbox escape attacks much harder.

That structural change makes the same class of sandbox escape significantly harder to pull off in future.

Threat intelligence firm Defused confirmed active exploitation in the wild on Saturday, noting that attackers are hitting the same /assessment_thanks.do sink documented in the Searchlight PoC but reaching code execution via a different gadget chain.

ServiceNow’s official advisory still states it is “not currently aware of exploitation against ServiceNow instances.” Self-hosted customers who haven’t applied the July 13 patches should treat this as urgent, the window between disclosure and weaponization closed in under 72 hours.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, artificial intelligence)