ServiceNow AI Platform Sandbox Escape Enables Unauthenticated Remote Code Execution (CVE-2026-6875)
ServiceNow AI Platform Sandbox Escape Enables (TL-2026-1305) is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-07-14 and last reviewed 2026-07-22. It has no confirmed attribution, affects ServiceNow ServiceNow AI Platform, references 1 CVE (CVE-2026-6875), maps to 27 MITRE ATT&CK techniques (T1059, T1059.007, T1068), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-1305
- Threat ID
- TL-2026-1305
- Severity
- CRITICAL
- CVSS
- 9.5 (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-14
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, manufacturing, retail, telecoms, education
- Target regions
- North America, Europe, Asia Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 35
- Updates
- 2026-07-22 · revalidated 1× · latest source
CVE-2026-6875 is a critical sandbox escape vulnerability (CVSS 4.0: 9.5) in the ServiceNow AI Platform that lets an unauthenticated remote attacker break out of the platform's restricted AI execution environment and run arbitrary code. ServiceNow patched hosted and self-hosted deployments on July 13, 2026 and reports no evidence of active exploitation, but withheld exploit mechanics to slow attacker weaponization.
How ServiceNow AI Platform Sandbox Escape Enables works
ServiceNow disclosed CVE-2026-6875 on July 13, 2026 via security advisory KB3137947, describing a sandbox escape flaw in the ServiceNow AI Platform's containment layer for AI-driven processes. The AI Platform sandbox is designed to isolate untrusted AI-generated or AI-processed inputs — including workloads run through Now Assist and other embedded generative-AI workflows — from the broader Now Platform application stack; a successful escape breaks that isolation and allows an attacker to execute code directly within the platform. Critically, exploitation requires no authentication, meaning any network-reachable, unpatched instance — hosted or self-hosted — is potentially exposed to unauthenticated remote code execution.
ServiceNow assigned a CVSS 4.0 score of 9.5 (Critical), vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, and mapped the flaw to CWE-94 (Improper Control of Generation of Code / Code Injection), consistent with an AI-generated-code-execution sandbox bypass. The vulnerability was reserved in the CVE program on April 22, 2026 and publicly disclosed on July 13, 2026, with the record updated July 14, 2026. Discovery is credited to security researcher Adam Kues of Assetnote, a researcher with a documented history of ServiceNow vulnerability research (Assetnote's prior published work with Kues covers CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217 — unauthenticated Glide-scripting-language code execution, arbitrary MID Server command execution, and local file read issues in earlier ServiceNow releases).
ServiceNow withheld the specific escape technique and proof-of-concept details from the public advisory — explicitly stating it has not disclosed "technical details about the exploit, attack prerequisites, affected components, or a proof of concept" — an intentional choice to give self-hosted customers a patching window before exploit code could be reverse-engineered from the fix. The vendor states it has no evidence of the flaw being exploited in the wild against customer instances as of the July 13, 2026 disclosure, and CVE-2026-6875 does not appear in the CISA Known Exploited Vulnerabilities catalog as of July 14, 2026.
Security reporting on the flaw characterizes the downstream risk of a successful escape as including unauthorized access to sensitive business data and IT service records, workflow manipulation, credential and API token theft, lateral movement through other enterprise applications connected to the instance, and disruption of IT operations — consistent with an attacker obtaining arbitrary code execution inside a central ITSM/workflow-automation platform that typically holds broad integration credentials and cross-system access.
Affected releases span four ServiceNow release trains: Australia (fixed in Patch 2), Yokohama (fixed in Patch 12 Hot Fix 1b or Patch 13), Zurich (fixed in Patch 7b or Patch 9), and Brazil (fixed as of the Early Access and General Availability releases). ServiceNow has already deployed the fix to all hosted instances; self-hosted and partner-hosted customers must apply the corresponding patch manually. Supplementary guidance was published under KB2930717 and KB2930740. This is the second unauthenticated RCE disclosed against the ServiceNow AI Platform's sandbox in 2026: the first, CVE-2026-0542 (CWE-653, CVSS 4.0 9.8), was proactively patched on hosted instances on January 6, 2026 ahead of public disclosure and involved a distinct root cause reported as a prototype-pollution vector combined with an overlooked Java-backend reflection path, affecting the Zurich, Yokohama, and Xanadu release trains. Two critical, unauthenticated sandbox-escape RCEs against the same AI Platform containment layer within roughly six months underscores that layer as a recurring high-value target for vulnerability research.
MITRE ATT&CK techniques used in TL-2026-1305
Execution
T1059 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter: JavaScript; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts
Discovery
T1082 System Information Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Command and Control
Persistence
T1098 Account Manipulation; T1136 Create Account; T1505.003 Server Software Component: Web Shell
Initial Access
T1190 Exploit Public-Facing Application
Lateral Movement
T1210 Exploitation of Remote Services
Defense Evasion
T1211 Exploitation for Stealth
Collection
T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Credential Access
T1528 Steal Application Access Token; T1552 Unsecured Credentials
Impact
T1531 Account Access Removal; T1565.001 Data Manipulation: Stored Data Manipulation
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1587 Develop Capabilities; T1588.005 Obtain Capabilities: Exploits
Reconnaissance
T1595.002 Active Scanning: Vulnerability Scanning
privilege-escalation
defense-impairment
Affected products and versions in ServiceNow AI Platform Sandbox Escape Enables
- ServiceNow — ServiceNow AI Platform
Vulnerable versions: Australia (before Patch 2); Yokohama (before Patch 12 Hot Fix 1b / Patch 13); Zurich (before Patch 7b / Patch 9); Brazil (before Early Access / General Availability)
Fixed in: Australia Patch 2; Yokohama Patch 12 Hot Fix 1b; Yokohama Patch 13; Zurich Patch 7b; Zurich Patch 9; Brazil Early Access; Brazil General Availability
Remediation for ServiceNow AI Platform Sandbox Escape Enables
Patches
- Australia Patch 2
- Yokohama Patch 12 Hot Fix 1b or Patch 13
- Zurich Patch 7b or Patch 9
- Brazil Early Access / General Availability release
Immediate actions
- Apply the ServiceNow patch for your release train immediately: Australia Patch 2, Yokohama Patch 12 Hot Fix 1b or Patch 13, Zurich Patch 7b or Patch 9, or move to the Brazil EA/GA release.
- For self-hosted and partner-hosted ServiceNow instances, verify the fix has been applied — hosted (ServiceNow-managed) instances were patched automatically by the vendor.
- Review ServiceNow KB3137947, KB2930717, and KB2930740 for instance-specific guidance and confirm patch application via the Now Support portal.
Workarounds
- No public workaround was disclosed; ServiceNow withheld exploit mechanics, so patching is the only confirmed mitigation.
Longer-term hardening
- Restrict network exposure of ServiceNow AI Platform components, including Now Assist and other generative-AI workflow entry points, to only required consumers; avoid unnecessary public-facing exposure of AI Platform endpoints.
- Establish a recurring ServiceNow security-advisory review process given the AI Platform sandbox's history of critical unauthenticated RCE findings (CVE-2026-6875, CVE-2026-0542).
- Rotate and scope down integration credentials/API tokens accessible from the AI Platform, and audit connected third-party/enterprise application trust relationships given the reported lateral-movement and credential-theft risk of a sandbox escape.
- Monitor ServiceNow instance logs and available API/audit trails for anomalous AI Platform invocation patterns or unexpected code-execution activity.
CVEs associated with ServiceNow AI Platform Sandbox Escape Enables
Weaknesses (CWE) in ServiceNow AI Platform Sandbox Escape Enables
CWE-94
Timeline of ServiceNow AI Platform Sandbox Escape Enables
- ServiceNow proactively patches hosted instances against the related CVE-2026-0542 (CWE-653, CVSS 4.0 9.8), an earlier unauthenticated AI Platform sandbox-escape RCE affecting the Zurich, Yokohama, and Xanadu release trains — the first of two critical AI Platform sandbox RCEs addressed in 2026.
- Searchlight Cyber's Assetnote research team discovers the pre-authentication sandbox escape and reports CVE-2026-6875 to ServiceNow.
- ServiceNow deploys an emergency mitigation to hosted instances within 24 hours, blocking redefinition of the specific JavaScript prototype functions used in the reported gadget chain.
- CVE-2026-6875 reserved in the MITRE CVE program, ahead of public disclosure.
- ServiceNow begins rolling out formal 'Guarded Script' patches to self-hosted/self-managed customers across the Australia, Yokohama, Zurich, and Brazil release families.
- Discoverer Adam Kues, credited via Assetnote, is identified as a researcher with a documented history of ServiceNow vulnerability disclosure, including prior unauthenticated code-execution and file-read issues (CVE-2024-4879, CVE-2024-5178, CVE-2024-5217) via Glide scripting and MID Server abuse.
- ServiceNow states it has no evidence of active exploitation of CVE-2026-6875 against customer instances at time of disclosure.
- ServiceNow deploys the fix to all hosted instances and publishes patched release versions (Australia Patch 2, Yokohama Patch 12 HF1b/Patch 13, Zurich Patch 7b/9, Brazil EA/GA) for self-hosted customers to apply.
- ServiceNow publicly discloses CVE-2026-6875, a critical unauthenticated sandbox-escape RCE in the AI Platform, via security advisory KB3137947, rated CVSS 4.0 9.5.
- Security news outlets (Cyber Security News, Cyberpress, Cryptika, GBHackers) report on the critical unauthenticated RCE flaw, detailing the risk of credential theft, workflow manipulation, and lateral movement, and urging customers to patch immediately.
- CVE-2026-6875 record and advisory updated with supplementary guidance referenced in KB2930717 and KB2930740.
- Public proof-of-concept exploit code for CVE-2026-6875 becomes broadly available.
- Threat intelligence firm Defused observes the first in-the-wild exploitation attempts against the /assessment_thanks.do endpoint, days after public disclosure.
- Defused confirms attackers are using a second, independently discovered sandbox-escape gadget chain in addition to the documented PoC route, evading defenses tuned only to the published exploit.
- ServiceNow publicly acknowledges active exploitation is occurring, reversing its earlier no-known-exploitation statement.
Update history for TL-2026-1305
- 2026-07-22 — CVE-2026-6875: Active Exploitation of ServiceNow AI Platform Pre-Auth Sandbox Escape RCE: What changed Exploitability THEORETICAL - ACTIVE; status PATCHED - ACTIVE, after Defused confirmed in-the-wild exploitation beginning 2026-07-17/18, days after Searchlight Cyber's full technical disclosure (including the GlideRecord/gs.incl
Sources cited for ServiceNow AI Platform Sandbox Escape Enables
- Critical ServiceNow Vulnerability Allows Remote Attackers to Execute Malicious Code
- Critical ServiceNow AI Platform Flaw Enables Unauthenticated Remote Code Execution
- Critical ServiceNow Vulnerability Allows Remote Attackers to Execute Malicious Code
- CVE-2026-6875 | THREATINT
- ServiceNow Security Advisory KB3137947 (CVE-2026-6875)
- CVE-2026-6875 Record
- NVD - CVE-2026-6875 Detail
- CISA Known Exploited Vulnerabilities Catalog (CVE-2026-6875 not listed as of 2026-07-14)
- Critical ServiceNow AI Platform Flaw Allows Unauthenticated Attackers to Escape Sandbox and Execute Remote Code
- CVE-2026-0542: ServiceNow AI Platform RCE Vulnerability
- CVE-2026-0542: CWE-653 Improper Isolation or Compartmentalization in ServiceNow AI Platform
- A Deep Dive into Three ServiceNow Vulnerabilities (with Adam Kues)
Threats related to ServiceNow AI Platform Sandbox Escape Enables
- ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Unauthenticated RCE/SQLi Bugs (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, CVE-2026-6876)
- Snowpick: Open-Source Scanner Exposes Widespread Unauthenticated Data Leakage in ServiceNow Instances (CVE-2025-3648 "Count(er) Strike" Context)
Detection coverage for TL-2026-1305
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1305 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.