ServiceNow AI Platform Sandbox Escape Enables Unauthenticated Remote Code Execution (CVE-2026-6875)

Key facts for ServiceNow AI platform sandbox escape

Detection coverage for ServiceNow AI platform sandbox escape

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1305 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Unauthenticated High-Rate Requests to ServiceNow AI Platform / Now Assist Endpoints (CVE-2026-6875 Exploitation Attempt)

Detects a burst of unauthenticated HTTP requests to ServiceNow AI Platform / Now Assist endpoints from a single source, consistent with vulnerability scanning or exploitation attempts against the CVE-2026-6875 sandbox-escape flaw.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.002
• Data sources: proxy, waf_logs, reverse_proxy_access_logs
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="pan:threat" OR sourcetype="squid" (uri_path="*ai-platform*" OR uri_path="*now-assist*" OR uri_path="*/api/now/*") (cs_username="-" OR user="" OR user="unknown")
| bin _time span=5m
| stats count dc(uri_path) as endpoints_hit values(uri_path) as paths by src_ip, _time
| where count > 20
| sort -count

Microsoft KQL

let lookback = 24h;
let threshold = 20;
SecurityEvent
| where Timestamp > ago(lookback)
| union (DeviceNetworkEvents | where Timestamp > ago(lookback))
| where RemoteUrl has_any ("ai-platform", "now-assist", "/api/now/") or RequestURL has_any ("ai-platform", "now-assist", "/api/now/")
| where isempty(AccountName) or AccountName == "-"
| summarize RequestCount = count(), Endpoints = make_set(RemoteUrl) by bin(TimeGenerated, 5m), RemoteIP
| where RequestCount > threshold

Sigma

title: Unauthenticated Exploitation Attempt Against ServiceNow AI Platform Endpoint
id: 7a1e2f30-6875-4a1c-9d10-cve20266875sp1
status: experimental
description: Detects a pattern of unauthenticated high-rate requests to ServiceNow AI Platform / Now Assist endpoints consistent with vulnerability scanning or exploitation attempts for CVE-2026-6875.
references:
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6875
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
    - cve.2026.6875
logsource:
    category: proxy
    product: web
detection:
    selection:
        c-uri|contains:
            - '/ai-platform'
            - '/now-assist'
            - '/api/now/'
        cs-username: '-'
    timeframe: 5m
    condition: selection | count() by src_ip > 20
falsepositives:
    - Legitimate automated health checks or load-balancer probes against public AI Platform endpoints
    - Authorized vulnerability scanning by internal security teams
level: high

Known false positives:

• Legitimate automated health checks or CDN/load-balancer probes against public AI Platform endpoints
• Authorized vulnerability scanning by internal security or third-party pentest teams

Tuning notes: Tune the 20-request/5-minute threshold to the org's normal AI Platform/Now Assist traffic baseline; allowlist known scanner and load-balancer source IPs; narrow uri_path patterns to the exact tenant instance path if known.

• 🔒 Unauthenticated Requests Targeting ServiceNow AI Platform / Now Assist Endpoints · unlock with TL Creds
• 🔒 Post-Escape Scripting Artifact Creation on ServiceNow MID Server / Integration Host · unlock with TL Creds
• 🔒 Discovery and Lateral-Movement Chain from Compromised ServiceNow Integration Host · unlock with TL Creds
• 🔒 ServiceNow AI Platform Unauthenticated Sandbox-Escape Exploitation Attempt (Sigma Primary) · unlock with TL Creds
• 🔒 Suspicious Webshell-Style File Drop on ServiceNow-Adjacent Host (Sigma Primary) · unlock with TL Creds
• 🔒 ServiceNow Integration Host Credential/Token File Write (Sigma Primary, CVE-2026-6875 Post-RCE Pattern) · unlock with TL Creds
• 🔒 Post-Escape Sandbox Code Execution Artifact on ServiceNow Integration/MID Server Host (CWE-94) · unlock with TL Creds
• 🔒 ServiceNow Application Access Token Theft Followed by Anomalous Outbound Beacon Activity (C2/Exfil) · unlock with TL Creds

Indicators of compromise for ServiceNow AI platform sandbox escape

As of 2026-07-22, Threadlinqs Intelligence tracks 35 indicators of compromise for TL-2026-1305.

How ServiceNow AI platform sandbox escape works

ServiceNow disclosed CVE-2026-6875 on July 13, 2026 via security advisory KB3137947, describing a sandbox escape flaw in the ServiceNow AI Platform's containment layer for AI-driven processes. The AI Platform sandbox is designed to isolate untrusted AI-generated or AI-processed inputs — including workloads run through Now Assist and other embedded generative-AI workflows — from the broader Now Platform application stack; a successful escape breaks that isolation and allows an attacker to execute code directly within the platform. Critically, exploitation requires no authentication, meaning any network-reachable, unpatched instance — hosted or self-hosted — is potentially exposed to unauthenticated remote code execution.

ServiceNow assigned a CVSS 4.0 score of 9.5 (Critical), vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, and mapped the flaw to CWE-94 (Improper Control of Generation of Code / Code Injection), consistent with an AI-generated-code-execution sandbox bypass. The vulnerability was reserved in the CVE program on April 22, 2026 and publicly disclosed on July 13, 2026, with the record updated July 14, 2026. Discovery is credited to security researcher Adam Kues of Assetnote, a researcher with a documented history of ServiceNow vulnerability research (Assetnote's prior published work with Kues covers CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217 — unauthenticated Glide-scripting-language code execution, arbitrary MID Server command execution, and local file read issues in earlier ServiceNow releases).

ServiceNow withheld the specific escape technique and proof-of-concept details from the public advisory — explicitly stating it has not disclosed "technical details about the exploit, attack prerequisites, affected components, or a proof of concept" — an intentional choice to give self-hosted customers a patching window before exploit code could be reverse-engineered from the fix. The vendor states it has no evidence of the flaw being exploited in the wild against customer instances as of the July 13, 2026 disclosure, and CVE-2026-6875 does not appear in the CISA Known Exploited Vulnerabilities catalog as of July 14, 2026.

Security reporting on the flaw characterizes the downstream risk of a successful escape as including unauthorized access to sensitive business data and IT service records, workflow manipulation, credential and API token theft, lateral movement through other enterprise applications connected to the instance, and disruption of IT operations — consistent with an attacker obtaining arbitrary code execution inside a central ITSM/workflow-automation platform that typically holds broad integration credentials and cross-system access.

Affected releases span four ServiceNow release trains: Australia (fixed in Patch 2), Yokohama (fixed in Patch 12 Hot Fix 1b or Patch 13), Zurich (fixed in Patch 7b or Patch 9), and Brazil (fixed as of the Early Access and General Availability releases). ServiceNow has already deployed the fix to all hosted instances; self-hosted and partner-hosted customers must apply the corresponding patch manually. Supplementary guidance was published under KB2930717 and KB2930740. This is the second unauthenticated RCE disclosed against the ServiceNow AI Platform's sandbox in 2026: the first, CVE-2026-0542 (CWE-653, CVSS 4.0 9.8), was proactively patched on hosted instances on January 6, 2026 ahead of public disclosure and involved a distinct root cause reported as a prototype-pollution vector combined with an overlooked Java-backend reflection path, affecting the Zurich, Yokohama, and Xanadu release trains. Two critical, unauthenticated sandbox-escape RCEs against the same AI Platform containment layer within roughly six months underscores that layer as a recurring high-value target for vulnerability research.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts

Discovery

T1082 System Information Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Command and Control

T1090 Proxy

Persistence

T1098 Account Manipulation; T1136 Create Account; T1505.003 Server Software Component: Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Collection

T1213 Data from Information Repositories; T1530 Data from Cloud Storage

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Impact

T1531 Account Access Removal; T1565.001 Data Manipulation: Stored Data Manipulation

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1587 Develop Capabilities; T1588.005 Obtain Capabilities: Exploits

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

privilege-escalation

T1611 Escape to Host

defense-impairment

T1685 Disable or Modify Tools

Remediation for ServiceNow AI platform sandbox escape

Patches

• Australia Patch 2
• Yokohama Patch 12 Hot Fix 1b or Patch 13
• Zurich Patch 7b or Patch 9
• Brazil Early Access / General Availability release

Immediate actions

• Apply the ServiceNow patch for your release train immediately: Australia Patch 2, Yokohama Patch 12 Hot Fix 1b or Patch 13, Zurich Patch 7b or Patch 9, or move to the Brazil EA/GA release.
• For self-hosted and partner-hosted ServiceNow instances, verify the fix has been applied — hosted (ServiceNow-managed) instances were patched automatically by the vendor.
• Review ServiceNow KB3137947, KB2930717, and KB2930740 for instance-specific guidance and confirm patch application via the Now Support portal.

Workarounds

• No public workaround was disclosed; ServiceNow withheld exploit mechanics, so patching is the only confirmed mitigation.

Longer-term hardening

• Restrict network exposure of ServiceNow AI Platform components, including Now Assist and other generative-AI workflow entry points, to only required consumers; avoid unnecessary public-facing exposure of AI Platform endpoints.
• Establish a recurring ServiceNow security-advisory review process given the AI Platform sandbox's history of critical unauthenticated RCE findings (CVE-2026-6875, CVE-2026-0542).
• Rotate and scope down integration credentials/API tokens accessible from the AI Platform, and audit connected third-party/enterprise application trust relationships given the reported lateral-movement and credential-theft risk of a sandbox escape.
• Monitor ServiceNow instance logs and available API/audit trails for anomalous AI Platform invocation patterns or unexpected code-execution activity.

Affected and fixed versions

• ServiceNow — ServiceNow AI Platform
  Vulnerable versions: Australia (before Patch 2); Yokohama (before Patch 12 Hot Fix 1b / Patch 13); Zurich (before Patch 7b / Patch 9); Brazil (before Early Access / General Availability)
  Fixed in: Australia Patch 2; Yokohama Patch 12 Hot Fix 1b; Yokohama Patch 13; Zurich Patch 7b; Zurich Patch 9; Brazil Early Access; Brazil General Availability

Timeline of ServiceNow AI platform sandbox escape

Last updated 2026-07-22 · revalidated 1× · latest source

• 2026-01-06 locked-ioc-17 proactively patches hosted instances against the related CVE-2026-0542 (CWE-653, CVSS 4.0 9.8), an earlier unauthenticated AI Platform sandbox-escape RCE affecting the Zurich, Yokohama, and Xanadu release trains — the first of two critical AI Platform sandbox RCEs addressed in 2026.
• 2026-04-01 Searchlight Cyber's locked-ioc-19 research team discovers the pre-authentication sandbox escape and reports CVE-2026-6875 to locked-ioc-17.
• 2026-04-02 locked-ioc-17 deploys an emergency mitigation to hosted instances within 24 hours, blocking redefinition of the specific JavaScript prototype functions used in the reported gadget chain.
• 2026-04-22 CVE-2026-6875 reserved in the MITRE CVE program, ahead of public disclosure.
• 2026-06-01 locked-ioc-17 begins rolling out formal 'Guarded Script' patches to self-hosted/self-managed customers across the Australia, Yokohama, Zurich, and Brazil release families.
• 2026-07-13 Discoverer locked-ioc-18, credited via locked-ioc-19, is identified as a researcher with a documented history of locked-ioc-17 vulnerability disclosure, including prior unauthenticated code-execution and file-read issues (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) via Glide scripting and MID Server abuse.
• 2026-07-13 locked-ioc-17 states it has no evidence of active exploitation of CVE-2026-6875 against customer instances at time of disclosure.
• 2026-07-13 locked-ioc-17 deploys the fix to all hosted instances and publishes patched release versions (Australia Patch 2, Yokohama Patch 12 HF1b/Patch 13, Zurich Patch 7b/9, Brazil EA/GA) for self-hosted customers to apply.
• 2026-07-13 locked-ioc-17 publicly discloses CVE-2026-6875, a critical unauthenticated sandbox-escape RCE in the AI Platform, via security advisory KB3137947, rated CVSS 4.0 9.5.
• 2026-07-14 Security news outlets (Cyber Security News, Cyberpress, Cryptika, GBHackers) report on the critical unauthenticated RCE flaw, detailing the risk of credential theft, workflow manipulation, and lateral movement, and urging customers to patch immediately.
• 2026-07-14 CVE-2026-6875 record and advisory updated with supplementary guidance referenced in KB2930717 and KB2930740.
• 2026-07-15 Public proof-of-concept exploit code for CVE-2026-6875 becomes broadly available.
• 2026-07-17 Threat intelligence firm locked-ioc-20 observes the first in-the-wild exploitation attempts against the locked-ioc-16 endpoint, days after public disclosure.
• 2026-07-18 locked-ioc-20 confirms attackers are using a second, independently discovered sandbox-escape gadget chain in addition to the documented PoC route, evading defenses tuned only to the published exploit.
• 2026-07-19 locked-ioc-17 publicly acknowledges active exploitation is occurring, reversing its earlier no-known-exploitation statement.

Update history

• 2026-07-22 — CVE-2026-6875: Active Exploitation of locked-ioc-13 Pre-Auth Sandbox Escape RCE: What changed Exploitability THEORETICAL - ACTIVE; status PATCHED - ACTIVE, after locked-ioc-20 confirmed in-the-wild exploitation beginning 2026-07-17/18, days after Searchlight Cyber's full technical disclosure (including the GlideRecord/g

Sources cited for ServiceNow AI platform sandbox escape

• CVE-2026-6875 Record CVE Program · Advisory · 2026-07-13
• NVD - CVE-2026-6875 Detail NVD (NIST) · Advisory · 2026-07-13
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-6875 not listed as of 2026-07-14) CISA · Government advisory · 2026-07-14
• CVE-2026-6875 | THREATINT cve.threatint.eu · Research · 2026-07-14
• ServiceNow Security Advisory KB3137947 (CVE-2026-6875) support.servicenow.com · Vendor report · 2026-07-13
• CVE-2026-0542: ServiceNow AI Platform RCE Vulnerability SentinelOne · Research · 2026-01-06
• CVE-2026-0542: CWE-653 Improper Isolation or Compartmentalization in ServiceNow AI Platform radar.offseq.com · Research · 2026-01-06
• A Deep Dive into Three ServiceNow Vulnerabilities (with Adam Kues) assetnote.io · Research · 2024-01-01
• Critical ServiceNow Vulnerability Allows Remote Attackers to Execute Malicious Code cryptika.com · Blog · 2026-07-13
• Critical ServiceNow Vulnerability Allows Remote Attackers to Execute Malicious Code cybersecuritynews.com · News · 2026-07-14
• Critical ServiceNow AI Platform Flaw Enables Unauthenticated Remote Code Execution cyberpress.org · News · 2026-07-13
• Critical ServiceNow AI Platform Flaw Allows Unauthenticated Attackers to Escape Sandbox and Execute Remote Code gbhackers.com · News · 2026-07-13

Threats related to ServiceNow AI platform sandbox escape

• ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876)
• Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context)

Previous and next in vulnerability

• Cursor AI Code Editor Autorun Flaw Enables Silent Code Execution via Malicious Repositories Next report