ServiceNow AI Platform Bug Under Active Attack - Patch Now

A critical vulnerability in ServiceNow's AI Platform is being actively exploited in the wild, security firm Defused Cyber warned this week. The flaw, tracked as CVE-2026-6875 and carrying a severity score of 9.5, allows an unauthenticated attacker to break out of a sandboxed environment and execute arbitrary code on affected systems.

ServiceNow released patches throughout June for several versions, including Brazil EA and GA, Australia Patch 2, Zurich Patch 7b and 9, and Yokohama Patch 12 Hot Fix 1b and Patch 13. Researcher Adam Kues noted that beyond the fix, ServiceNow is also tightening sandbox restrictions to prevent similar escapes. Searchlight Cyber, which disclosed technical details, reported the issue on April 1 and said the exploit can fully compromise the ServiceNow instance and any linked proxy servers.

According to Defused, attackers are targeting the pre-authentication endpoint "/assessment_thanks.do" with HTTP POST requests, using a sandbox-escape gadget that leads to code execution via a different path than previously documented proof-of-concept exploits. Customers running self-hosted versions who haven't yet applied the patches are urged to do so immediately to block the threat.

Source: The Hackers News