Critical Cloud Alert: ServiceNow Pre-Auth RCE Actively Exploited in the Wild (CVE-2026-6875)
Executive Summary
Enterprise IT service provider ServiceNow has issued urgent security advisories following confirmed reports of active, in-the-wild exploitation targeting its Now Platform instances. Tracked as CVE-2026-6875, the critical vulnerability allows an unauthenticated remote attacker to execute arbitrary code on backend ServiceNow application servers. Threat actors are actively scanning the internet and delivering malicious HTTP payloads to hijack enterprise IT workflows, exfiltrate sensitive configuration data, and establish persistent administrative footholds inside corporate networks.
Technical Analysis of CVE-2026-6875
The vulnerability stems from improper input sanitization inside ServiceNow's core Jelly script evaluation engine, accessible via public web API endpoints:
Technical Mechanics:
1. Unauthenticated API Entry Point: The flaw resides in public-facing HTTP endpoint handlers that parse user-supplied JSON or XML requests prior to session authentication.
2. Jelly Expression Template Injection: Attackers transmit crafted HTTP POST requests containing malformed Jelly template tags. Because the input validation routine fails to sanitize expression delimiters, the application engine interprets the payload as trusted server-side code.
3. Arbitrary Code Execution: The executed Jelly script triggers backend Java reflection routines, allowing the unauthenticated remote attacker to invoke underlying operating system commands with full web-service execution privileges (servicenow service user).
4. Active Exploitation Campaigns: Threat intelligence feeds report that threat actors are leveraging automated mass-scanning scripts to identify unpatched ServiceNow portals, immediately dropping backdoors, harvesting OAuth tokens, and querying internal CMDB (Configuration Management Database) asset inventories.
* Vulnerability Identifier: CVE-2026-6875
* Vulnerability Class: Improper Input Neutralization / Server-Side Template Injection (CWE-94)
* CVSS Score: 9.8 (Critical Severity) / Unauthenticated Remote Exploitation
* Affected Software: ServiceNow Now Platform (Washington DC, Xanadu, and earlier family releases)
* Status: Active Exploitation Confirmed in the Wild
Widespread Risks to Enterprise IT Infrastructure
ServiceNow is the central operational hub for thousands of Fortune 500 enterprises, managing IT ticketing, asset management, identity provisioning, and internal security incident response. A successful pre-authentication compromise of a ServiceNow instance gives threat actors unrestricted access to corporate IT topologies, administrative credentials, and internal escalation pathways.
Because ServiceNow instances frequently possess high-privilege API integrations into Active Directory, cloud providers, and HR platforms, compromising the ServiceNow server provides an ideal launching pad for catastrophic domain-wide intrusions.
Recommendations and Mitigations
Organizations running ServiceNow instances must take immediate protective action:
1. Apply Hotfixes and Upgrades Immediately: Download and apply the official emergency hotfixes released by ServiceNow for Washington DC, Xanadu, and supported family versions.
2. Restrict Access to Public Instance Endpoints: Implement IP whitelisting or place ServiceNow administrative endpoints behind zero-trust access proxies (ZTNA) to block unauthenticated external traffic.
3. Deploy Web Application Firewall (WAF) Rules: Configure WAF inspect rules to detect and block incoming HTTP requests containing Jelly expression syntax (e.g.,
4. Audit ServiceNow System Logs and CMDB Activity: Review transaction logs (syslog_transaction) for abnormal HTTP 200 responses from unauthenticated REST endpoints and inspect CMDB tables for unexpected administrative script creations.