# ServiceNow AI Platform Sandbox Escape Enables Unauthenticated Remote Code Execution (CVE-2026-6875)

> CVE-2026-6875 is a critical sandbox escape vulnerability (CVSS 4.0: 9.5) in the ServiceNow AI Platform that lets an unauthenticated remote attacker break out of the platform's restricted AI execution environment and run arbitrary code. ServiceNow patched hosted and self-hosted deployments on July 13, 2026 and reports no evidence of active exploitation, but withheld exploit mechanics to slow attacker weaponization.

- **Published:** 2026-07-14T00:00:00Z
- **Last reviewed:** 2026-07-22T05:29:03.222Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1305
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-servicenow-ai-platform-sandbox-escape-tl-2026-1305.webp?v=7b04707b (Threadlinqs threat intel: CVE-2026-6875 ServiceNow Sandbox Escape: Detection & IOCs (TL-2026-1305) — Critical severity, 35 IOCs, 9 detection rules.)
- **ID:** TL-2026-1305
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 35
- **CVEs:** CVE-2026-6875, CVE-2026-0542

## Description

ServiceNow disclosed CVE-2026-6875 on July 13, 2026 via security advisory KB3137947, describing a sandbox escape flaw in the ServiceNow AI Platform's containment layer for AI-driven processes. The AI Platform sandbox is designed to isolate untrusted AI-generated or AI-processed inputs — including workloads run through Now Assist and other embedded generative-AI workflows — from the broader Now Platform application stack; a successful escape breaks that isolation and allows an attacker to execute code directly within the platform. Critically, exploitation requires no authentication, meaning any network-reachable, unpatched instance — hosted or self-hosted — is potentially exposed to unauthenticated remote code execution.

ServiceNow assigned a CVSS 4.0 score of 9.5 (Critical), vector CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, and mapped the flaw to CWE-94 (Improper Control of Generation of Code / Code Injection), consistent with an AI-generated-code-execution sandbox bypass. The vulnerability was reserved in the CVE program on April 22, 2026 and publicly disclosed on July 13, 2026, with the record updated July 14, 2026. Discovery is credited to security researcher Adam Kues of Assetnote, a researcher with a documented history of ServiceNow vulnerability research (Assetnote's prior published work with Kues covers CVE-2024-4879, CVE-2024-5178, and CVE-2024-5217 — unauthenticated Glide-scripting-language code execution, arbitrary MID Server command execution, and local file read issues in earlier ServiceNow releases).

ServiceNow withheld the specific escape technique and proof-of-concept details from the public advisory — explicitly stating it has not disclosed "technical details about the exploit, attack prerequisites, affected components, or a proof of concept" — an intentional choice to give self-hosted customers a patching window before exploit code could be reverse-engineered from the fix. The vendor states it has no evidence of the flaw being exploited in the wild against customer instances as of the July 13, 2026 disclosure, and CVE-2026-6875 does not appear in the CISA Known Exploited Vulnerabilities catalog as of July 14, 2026.

Security reporting on the flaw characterizes the downstream risk of a successful escape as including unauthorized access to sensitive business data and IT service records, workflow manipulation, credential and API token theft, lateral movement through other enterprise applications connected to the instance, and disruption of IT operations — consistent with an attacker obtaining arbitrary code execution inside a central ITSM/workflow-automation platform that typically holds broad integration credentials and cross-system access.

Affected releases span four ServiceNow release trains: Australia (fixed in Patch 2), Yokohama (fixed in Patch 12 Hot Fix 1b or Patch 13), Zurich (fixed in Patch 7b or Patch 9), and Brazil (fixed as of the Early Access and General Availability releases). ServiceNow has already deployed the fix to all hosted instances; self-hosted and partner-hosted customers must apply the corresponding patch manually. Supplementary guidance was published under KB2930717 and KB2930740. This is the second unauthenticated RCE disclosed against the ServiceNow AI Platform's sandbox in 2026: the first, CVE-2026-0542 (CWE-653, CVSS 4.0 9.8), was proactively patched on hosted instances on January 6, 2026 ahead of public disclosure and involved a distinct root cause reported as a prototype-pollution vector combined with an overlooked Java-backend reflection path, affecting the Zurich, Yokohama, and Xanadu release trains. Two critical, unauthenticated sandbox-escape RCEs against the same AI Platform containment layer within roughly six months underscores that layer as a recurring high-value target for vulnerability research.

## MITRE ATT&CK

- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1505.003 Server Software Component: Web Shell
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1211 Exploitation for Stealth
- T1528 Steal Application Access Token
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1567 Exfiltration Over Web Service
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1587 Develop Capabilities
- T1203 Exploitation for Client Execution
- T1136 Create Account
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1530 Data from Cloud Storage
- T1090 Proxy
- T1531 Account Access Removal

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unauthenticated High-Rate Requests to ServiceNow AI Platform / Now Assist Endpoints (CVE-2026-6875 Exploitation Attempt)** (`TL-2026-1305-SPL-001`)

Detects a burst of unauthenticated HTTP requests to ServiceNow AI Platform / Now Assist endpoints from a single source, consistent with vulnerability scanning or exploitation attempts against the CVE-2026-6875 sandbox-escape flaw.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.002
- **Data sources:** proxy, waf_logs, reverse_proxy_access_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="pan:threat" OR sourcetype="squid" (uri_path="*ai-platform*" OR uri_path="*now-assist*" OR uri_path="*/api/now/*") (cs_username="-" OR user="" OR user="unknown")
| bin _time span=5m
| stats count dc(uri_path) as endpoints_hit values(uri_path) as paths by src_ip, _time
| where count > 20
| sort -count
```

### Microsoft KQL

```kql
let lookback = 24h;
let threshold = 20;
SecurityEvent
| where Timestamp > ago(lookback)
| union (DeviceNetworkEvents | where Timestamp > ago(lookback))
| where RemoteUrl has_any ("ai-platform", "now-assist", "/api/now/") or RequestURL has_any ("ai-platform", "now-assist", "/api/now/")
| where isempty(AccountName) or AccountName == "-"
| summarize RequestCount = count(), Endpoints = make_set(RemoteUrl) by bin(TimeGenerated, 5m), RemoteIP
| where RequestCount > threshold
```

### Sigma

```yaml
title: Unauthenticated Exploitation Attempt Against ServiceNow AI Platform Endpoint
id: 7a1e2f30-6875-4a1c-9d10-cve20266875sp1
status: experimental
description: Detects a pattern of unauthenticated high-rate requests to ServiceNow AI Platform / Now Assist endpoints consistent with vulnerability scanning or exploitation attempts for CVE-2026-6875.
references:
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6875
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-14
tags:
    - attack.initial-access
    - attack.t1190
    - attack.reconnaissance
    - attack.t1595.002
    - cve.2026.6875
logsource:
    category: proxy
    product: web
detection:
    selection:
        c-uri|contains:
            - '/ai-platform'
            - '/now-assist'
            - '/api/now/'
        cs-username: '-'
    timeframe: 5m
    condition: selection | count() by src_ip > 20
falsepositives:
    - Legitimate automated health checks or load-balancer probes against public AI Platform endpoints
    - Authorized vulnerability scanning by internal security teams
level: high
```

**Known false positives:**

- Legitimate automated health checks or CDN/load-balancer probes against public AI Platform endpoints
- Authorized vulnerability scanning by internal security or third-party pentest teams

**Tuning notes:** Tune the 20-request/5-minute threshold to the org's normal AI Platform/Now Assist traffic baseline; allowlist known scanner and load-balancer source IPs; narrow uri_path patterns to the exact tenant instance path if known.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Unauthenticated Requests Targeting ServiceNow AI Platform / Now Assist Endpoints (locked: unlock with TL Creds)
- Post-Escape Scripting Artifact Creation on ServiceNow MID Server / Integration Host (locked: unlock with TL Creds)
- Discovery and Lateral-Movement Chain from Compromised ServiceNow Integration Host (locked: unlock with TL Creds)
- ServiceNow AI Platform Unauthenticated Sandbox-Escape Exploitation Attempt (Sigma Primary) (locked: unlock with TL Creds)
- Suspicious Webshell-Style File Drop on ServiceNow-Adjacent Host (Sigma Primary) (locked: unlock with TL Creds)
- ServiceNow Integration Host Credential/Token File Write (Sigma Primary, CVE-2026-6875 Post-RCE Pattern) (locked: unlock with TL Creds)
- Post-Escape Sandbox Code Execution Artifact on ServiceNow Integration/MID Server Host (CWE-94) (locked: unlock with TL Creds)
- ServiceNow Application Access Token Theft Followed by Anomalous Outbound Beacon Activity (C2/Exfil) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Critical ServiceNow Vulnerability Allows Remote Attackers to Execute Malicious Code](https://cybersecuritynews.com/servicenow-remote-malicious-code/)
- [Critical ServiceNow AI Platform Flaw Enables Unauthenticated Remote Code Execution](https://cyberpress.org/critical-servicenow-ai-platform-flaw/)
- [Critical ServiceNow Vulnerability Allows Remote Attackers to Execute Malicious Code](https://www.cryptika.com/critical-servicenow-vulnerability-allows-remote-attackers-to-execute-malicious-code/)
- [CVE-2026-6875 | THREATINT](https://cve.threatint.eu/CVE/CVE-2026-6875)
- [ServiceNow Security Advisory KB3137947 (CVE-2026-6875)](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947)
- [CVE-2026-6875 Record](https://www.cve.org/CVERecord?id=CVE-2026-6875)
- [NVD - CVE-2026-6875 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-6875)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-6875 not listed as of 2026-07-14)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Critical ServiceNow AI Platform Flaw Allows Unauthenticated Attackers to Escape Sandbox and Execute Remote Code](https://gbhackers.com/critical-servicenow-ai-platform-flaw/)
- [CVE-2026-0542: ServiceNow AI Platform RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-0542/)
- [CVE-2026-0542: CWE-653 Improper Isolation or Compartmentalization in ServiceNow AI Platform](https://radar.offseq.com/threat/cve-2026-0542-cwe-653-improper-isolation-or-compar-5d8d7dac)
- [A Deep Dive into Three ServiceNow Vulnerabilities (with Adam Kues)](https://www.assetnote.io/resources/blog/a-deep-dive-into-three-servicenow-vulnerabilities-with-adam-kues)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1305