Executive Summary
Cybersecurity researchers and vendor advisories have confirmed three maximum-severity vulnerabilities rated CVSS 10.0 impacting the ServiceNow Enterprise Cloud platform, including CVE-2026-6875 and associated template-evaluation flaws. These vulnerabilities allow unauthenticated remote threat actors to bypass perimeter identity controls, escape the internal JavaScript execution sandbox, and execute arbitrary code on underlying enterprise application instances. With over 85% of Fortune 500 enterprises relying on ServiceNow to manage critical IT operations, employee directories, and security incident workflows, these vulnerabilities represent one of the most severe enterprise SaaS threats of 2026.
Deep-Dive Technical Analysis
The vulnerability chain combines insecure template processing with a severe Java Reflection and Rhino/Nashorn script engine sandbox escape within ServiceNow’s core Glide platform.
1. Unauthenticated Public Endpoint Exposure: Several public-facing REST endpoints intended for guest self-service portals and OAuth redirection flows inadvertently process user-supplied input through internal Jelly and UI Page rendering engines without prior authentication checks.
2. Expression Language (EL) & Jelly Injection: An attacker can supply crafted payload parameters containing nested Jelly expressions ($[...] or ${...}) that are evaluated dynamically during page construction.
3. Sandbox Escape via GlideSystem APIs: Once inside the script evaluation context, the attacker bypasses the restricted JavaScript execution sandbox by abusing unescaped reflection pathways in underlying Java classes (java.lang.Runtime, java.lang.ProcessBuilder, and proprietary Glide wrappers).
4. Full Instance & Database Takeover: The resulting remote code execution operates under the context of the ServiceNow application runner, allowing the attacker to dump configuration databases, extract administrative API tokens, tamper with Configuration Management Database (CMDB) records, and exfiltrate internal IT change management logs.
Industry Impact
ServiceNow serves as the central nervous system for enterprise IT architectures:
* Direct Exposure of Crown Jewel Assets: CMDBs contain complete architectural blueprints of enterprise networks, internal IP mappings, server credentials, and cloud API keys.
* Supply Chain & Incident Response Hijacking: Attackers can intercept, alter, or silence ongoing security alerts and incident response tickets, blinding Security Operations Centers (SOCs) during an intrusion.
* Cloud-to-Ground Lateral Movement: Stolen enterprise credentials and connected Active Directory/LDAP integration tokens enable seamless lateral movement from cloud SaaS instances into internal corporate networks.
Recommendations & Mitigations
1. Apply Emergency ServiceNow Hotfixes: Immediately upgrade all production, sub-production, and developer instances to the latest patched patches (Vancouver, Washington DC, and Xanadu release families).
2. Restrict Public Portal Access: Utilize ServiceNow Access Control Lists (ACLs) and IP Access Rules to restrict exposure of administrative and developer endpoints to trusted internal IP ranges or corporate VPN gateways.
3. Audit Inbound Script Integrations: Review custom UI Pages, Scripted REST APIs, and Widget templates for any dynamic evaluation of untrusted parameters.
4. Monitor GlideRecord Queries: Implement automated SIEM/SOAR monitoring to detect abnormal bulk exports of sys_user, sys_user_has_role, or CMDB tables, especially those initiated from unauthenticated guest session IDs.