ServiceNow AI Platform Sandbox Escape (CVE-2026-6875) Under Active In-the-Wild Exploitation: Threat Actors Pivot via Alternative Gadget Chains
Executive Summary
A critical pre-authentication vulnerability in the ServiceNow AI Platform (formerly the Now Platform) tracked as CVE-2026-6875 (CVSS v4.0 score: 9.5 / CVSS v3.1: 9.8) is undergoing active in-the-wild exploitation. First unearthed by researchers at Searchlight Cyber in April 2026 and patched by ServiceNow in mid-July, the vulnerability enables unauthenticated remote attackers to break out of the platform's restricted JavaScript execution sandbox and achieve full Remote Code Execution (RCE) (SecurityWeek).
Following Searchlight Cyber's public publication of technical proof-of-concept (PoC) details on July 14, 2026, threat intelligence firm Defused Cyber observed weaponized exploitation attempts beginning July 18 (Help Net Security). Notably, threat actors have modified the public attack vector, utilizing an alternative sandbox-escape gadget chain while targeting the same pre-authentication endpoint (The Hacker News). While vendor-managed ServiceNow cloud instances were updated automatically, unpatched self-hosted enterprise deployments and partner-managed instances remain at critical risk of full platform takeover, unauthorized administrator account creation, and lateral movement into internal corporate networks via connected Management, Instrumentation, and Discovery (MID) Servers (RedLegg Security Bulletin).
Deep-Dive Technical Analysis
Root Cause & The Sandbox Escape Primitive
The ServiceNow AI Platform relies heavily on server-side JavaScript to power custom business logic, automated workflows, and AI agent extensions. To prevent untrusted input from running arbitrary code on the host, ServiceNow executes user-supplied code within a restricted script sandbox designed to isolate execution and limit access to Java reflection, system calls, and sensitive platform APIs (Penligent Hacking Labs).
CVE-2026-6875 stems from CWE-94: Improper Control of Generation of Code. Specifically, an unauthenticated attacker can reach an unauthenticated HTTP entry point—most prominently the /assessment_thanks.do endpoint—and pass crafted inputs (such as the sysparm_assessable_type parameter containing javascript: expressions) that trigger dynamic script parsing (RedLegg Security Bulletin).
When processed by the platform's GlideRecord database abstraction layer and Script Include handler, the input bypasses initial validation checks. By constructing a sophisticated gadget chain across internal Script Includes and platform objects, the attacker breaks out of the restricted script sandbox into the broader platform execution context, unlocking full server-side privileges (Penligent Hacking Labs).
Attack Flow Lifecycle:
1. Unauthenticated Attacker: Initiates HTTP POST to /assessment_thanks.do.
2. Payload Injection: The sysparm_assessable_type parameter contains a malicious javascript: expression.
3. Validation Bypass: Improper validation in GlideRecord and Script Include processing allows execution.
4. Sandbox Escape: Attacker utilizes a gadget chain to move from the restricted sandbox to the full platform context.
5. Remote Code Execution (RCE): Enables administrative account creation and pivoting to internal MID Servers.
The Public PoC vs. Real-World Exploitation Shift
A key insight into the threat dynamics of CVE-2026-6875 lies in how quickly threat actors adapted after public disclosure:
* Vendor Advisory (July 13, 2026): ServiceNow released advisory KB3137947, confirming fixes for hosted instances and distributing patches for self-hosted customers.
* Technical PoC Publication (July 14, 2026): Searchlight Cyber published analysis detailing the GlideRecord query behavior and the specific Script Include gadget chain (Help Net Security).
* In-the-Wild Weaponization (July 18, 2026): Defused Cyber detected active exploitation using a completely different sandbox-escape gadget chain from the one published by Searchlight Cyber (SecurityWeek).
This shift demonstrates that attackers did not merely copy-paste the public PoC; they used the architectural insights to uncover alternative exploitation paths, defeating simple static Web Application Firewall (WAF) string signatures (Penligent Hacking Labs).
Cloud-Hosted vs. Self-Hosted Deployment Exposure
The real-world blast radius of CVE-2026-6875 highlights the operational divide between SaaS/cloud-managed platforms and self-hosted enterprise infrastructure:
* ServiceNow Cloud-Hosted Instances: ServiceNow automatically applied security hotfixes in early July. Investigations have found no evidence of successful exploitation against vendor-hosted cloud instances (SecurityWeek).
* Self-Hosted & Partner-Managed Deployments: Enterprise environments operating on-premises, on private IaaS clouds, or via third-party managed service providers (MSPs) require manual administrative patching. These represent the primary attack surface currently targeted in the wild (Help Net Security).
Post-Exploitation Risks & MID Server Compromise
Compromising a ServiceNow instance carries severe secondary risks:
* Administrative Account Creation: Injecting rogue high-privilege users for persistent backdoor access.
* Sensitive Data Exfiltration: Accessing customer records, employee PII, and credentials via GlideRecord queries.
* MID Server Pivoting: An attacker with RCE on the platform can push malicious commands to connected MID Servers, pivoting directly into secure internal network segments (RedLegg Security Bulletin).
Actionable Recommendations & Mitigations
1. Immediate Patching & Guarded Script Enforcement
Verify that all instances have been updated to the following patched family releases (ServiceNow KB3137947):
ServiceNow Release Family
Required Minimum Version for Mitigation
Zurich
Patch 7b, Patch 9, or later
Yokohama
Patch 12 Hot Fix 1b, Patch 13, or later
Australia & Brazil
Family Patch 2 / GA releases
These updates enforce the Guarded Script feature, which restricts complex server-side scripts to validated Script Includes, neutralizing unauthenticated sandbox escapes.
2. Log Auditing & Threat Hunting
Conduct retro-active threat hunting across web server, WAF, and platform audit logs for indicators of compromise (IoCs):
* Web Entry Point Inspection: Search HTTP access logs for unauthenticated requests to /assessment_thanks.do, inspecting sysparm_assessable_type and javascript: keyword payloads (RedLegg Security Bulletin).
* Platform User & Audit Review: Audit for new administrative accounts, modifications to system properties (sys_properties), or unauthorized additions to sys_script_include.
* MID Server Process Monitoring: Inspect process execution logs for anomalous command execution originating from the ServiceNow application instance (RedLegg Security Bulletin).
3. Network Isolation & WAF Rules
* Place self-hosted interfaces behind a WAF with strict behavioral rules for pre-authentication endpoints.
* Enforce strict network segmentation between external ServiceNow instances and internal MID Servers, ensuring least-privilege service credentials.
References
* SecurityWeek — Exploitation of ServiceNow Vulnerability Seen Days After Disclosure
* Help Net Security — ServiceNow pre-auth RCE exploited in the wild (CVE-2026-6875)
* The Hacker News — Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated RCE
* ServiceNow Support Advisory KB3137947
* Penligent Hacking Labs — CVE-2026-6875 Technical Breakdown
* RedLegg Security Bulletin — ServiceNow AI Platform Sandbox Escape