CVE-2026-6875: ServiceNow Pre – Auth Sandbox Escape Exploited in Attacks

Attackers are actively exploiting a flaw in the ServiceNow AI Platform that lets anyone on the internet
run their own code on the system without a username or password. A successful attack gives full
control of the ServiceNow instance and of the connected servers that sit inside the corporate network.
ServiceNow has released fixes, and self-hosted customers who have not yet applied them should treat
this as an emergency patch.

1.Vulnerability Details

CVE ID – CVE-2026-6875
CVSS SCORE- 9.5 CVSS: 4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EXPLOIT STATUS – Active exploitation confirmed in the wild by Defused, first payloads observed 17 July 2026. ServiceNow states it is not currently aware of exploitation against the instances it hosts.

ServiceNow filters accept values that start with javascript:, and the platform evaluates them. User input reaching GlideRecord.addQuery therefore runs as script inside a restricted sandbox. ServiceNow loads script includes in a separate context that the sandbox does not constrain, so an attacker who redefines a global function that an include calls can force their own code to run outside the sandbox. Searchlight Cyber chained Object.defineProperty over the sealed Object.clone with the Function constructor, then triggered gs.include(‘ItemViewElementsProvider’) to obtain unsandboxed execution. CISA-ADP filed the flaw as CWE-94, Improper Control of Generation of Code (Code Injection).

2. Affected Products & Fixed Versions

3. Observed Activity

• Report and hosted mitigation (1 April 2026): Searchlight Cyber reported the flaw to ServiceNow, which deployed mitigations to all cloud instances within 24 hours by blocking modification of key JavaScript functions. Patches for the underlying issue followed through June.
• Public disclosure (13 July 2026): ServiceNow published KB3137947 and the CVE record, followed by Searchlight Cyber’s technical write-up on 14 July 2026 including a working sandbox escape chain.
• First exploitation (17 July 2026, 23:41): A Defused ServiceNow decoy recorded a POST to /assessment_thanks.do from 146.19.216[.]119 (AS134677, Dromatics Systems Pte Ltd) on port 443, carrying a URL-encoded sysparm_assessable_type value beginning with javascript:
• Second gadget chain confirmed (18 July 2026): Defused confirmed the payloads hit the same pre-authentication sink Searchlight Cyber documented, but the sandbox escape reaches the same code execution primitive by a different route than the published proof of concept. Detections written against the public PoC will not catch it.
• Probe payload behaviour The captured request chains Object.clone, Object.defineProperty, and AbstractAjaxProcessor.prototype into GlideController().evaluateAsObject, then calls gs.addInfoMessage with a String.fromCharCode marker. This is a validation probe that confirms code execution rather than a weaponised payload.
• Vendor position ServiceNow told BleepingComputer and Help Net Security it has seen no evidence the activity relates to instances it hosts, and urges self-hosted and hosted customers to apply the relevant patches.

4. Indicators of Compromise (IOCs)

TYPE – INDICATOR
IP – ASN 146.19.216[.]119
AS134677 (Dromatics Systems Pte Ltd)

5. Recommendations

• Identify every self-hosted ServiceNow AI Platform instance and confirm its family release and patch level against the fixed versions listed above.
• Apply the fixed release for your branch now: Australia Patch 2, Yokohama Patch 12 Hot Fix 1b or Patch 13, Zurich Patch 7b or Patch 9, or Brazil EA or GA.
• Hunt web and instance logs back to 13 July 2026 for requests to /assessment_thanks.do where sysparm_assessable_type starts with javascript:, and for the gadget strings Object.defineProperty and gs.include.
• Treat any instance with a confirmed hit as fully compromised: review sys_user for attacker-created admin accounts and rotate credentials on all connected MID and proxy servers.
• Monitor for the IOCs and block them at their respective controls, and restrict internet-facing access to ServiceNow instances where your deployment model allows it.
  

6. Sources

• https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
• https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/
• https://x.com/defusedcyber/status/2078418391321219448
• https://nvd.nist.gov/vuln/detail/CVE-2026-6875

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.