CVE-2026-6875: ServiceNow AI Platform — Unauthenticated Code Execution Risk (June 2026)

CVE-2026-6875 — ServiceNow AI Platform

CVE-2026-6875 is a critical vulnerability in the ServiceNow AI Platform that allows unauthenticated attackers to escape the sandbox and execute arbitrary code. The flaw is being actively exploited in the wild and carries a high risk of full system compromise. ServiceNow has issued patches as of June 2026 and urges immediate deployment.

Attack Vector

Attackers exploit CVE-2026-6875 remotely and without authentication. By targeting the AI Platform's sandbox environment, adversaries can break isolation controls and run arbitrary code on the underlying host. This permits lateral movement to connected proxy servers and enables full takeover of affected ServiceNow instances. No user interaction is required, and exploitation has been observed in non-hosted environments.

Who Is at Risk

All organizations running self-hosted ServiceNow AI Platform deployments are at elevated risk, especially if patches released in June 2026 have not been applied. While ServiceNow reports no exploitation on their hosted cloud instances, any unpatched self-managed or on-premises deployments are vulnerable to attack.

Patch & Mitigate

• Patch: Apply the official ServiceNow AI Platform security updates released June 2026 immediately.
• Workaround: No effective workaround is available; patching is mandatory.
• Detect: Monitor for unexpected outbound connections from ServiceNow hosts, unauthorized process creation, and signs of sandbox escape in application logs.

MITRE ATT&CK

• TA0005 — Defense Evasion: Attackers bypass sandbox restrictions to execute code outside intended boundaries.
• TA0006 — Credential Access: Exploitation may enable access to sensitive credentials stored within compromised instances.

Source: https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html