ServiceNow, the enterprise workflow automation platform powering over 100 billion workflows annually at 85% of Fortune 500 companies, is under active attack. A critical pre-authentication remote code execution vulnerability (CVE-2026-6875) allows unauthenticated attackers to escape the platform's JavaScript sandbox and execute arbitrary code on ServiceNow instances. Threat intelligence firm Defused confirmed in-the-wild exploitation starting July 18, 2026, yet ServiceNow's official advisory still states no evidence of exploitation has been observed.

Vulnerability Details (CVE-2026-6875, CVSS 9.8)

Attribute	Details
CVE ID	CVE-2026-6875
CVSS v3.1 Score	9.8 (Critical)
Attack Vector	Network (AV:N)
Attack Complexity	Low (AC:L)
Privileges Required	None (PR:N)
User Interaction	None (UI:N)
Scope	Unchanged (S:U)
Confidentiality	High (C:H)
Integrity	High (I:H)
Availability	High (A:H)
Affected Product	ServiceNow AI Platform (formerly Now Platform)
Affected Versions	All self-hosted instances prior to July 13, 2026 patches
Patch Date	July 13, 2026 (self-hosted); April 2026 (cloud instances)
Exploitation Status	Actively exploited in the wild (confirmed July 18)
CISA KEV Status	Not yet listed (as of July 27)

The vulnerability resides in ServiceNow's GlideRecord query API, which accepts user-supplied input in pre-authentication contexts. Attackers can inject JavaScript code via the javascript: operator in filter queries, then escape the script sandbox using a prototype pollution gadget chain involving Object.clone, Class.create.constructor, and AbstractAjaxProcessor.prototype.

Impact Assessment: What's at Risk

A successful exploit grants attackers unauthenticated remote code execution within the ServiceNow platform context. The impact extends far beyond the application layer:

Data Compromise: Attackers can read any table in the ServiceNow instance, including sensitive configuration data, user credentials, API keys, and business-critical records. Since ServiceNow often serves as a central CMDB and IT service management hub, this exposes infrastructure inventories, change management records, and incident response data.

Persistence and Lateral Movement: With code execution, attackers can create administrative users, modify ACLs, deploy malicious business rules, and establish persistent backdoors. ServiceNow's integration with MID servers (Management, Instrumentation, and Discovery) means compromised instances can execute commands on connected proxy servers, often residing in internal network segments.

Supply Chain Risk: ServiceNow instances frequently integrate with ITSM tools, monitoring platforms, identity providers, and cloud infrastructure APIs. A compromised instance becomes a pivot point for attacking connected systems.

Regulatory Exposure: Organizations subject to SOX, HIPAA, GDPR, or FedRAMP may face compliance violations if ServiceNow data containing PII, PHI, or financial records is accessed or exfiltrated.

Affected Systems: Who Needs to Act

Self-hosted ServiceNow instances that have not applied the July 13, 2026 security patches are directly vulnerable. This includes on-premises deployments and customer-managed cloud VPCs.

ServiceNow-hosted (SaaS) instances received mitigations in April 2026, but the vendor acknowledges that the underlying sandbox escape technique may still be exploitable via alternative gadget chains. All customers should verify their patch level.

MID Server deployments connected to vulnerable instances are at risk of remote command execution, as the sandbox escape allows invoking GlideController().evaluateAsObject() to run arbitrary Java code on the MID server host.

Integrations and connected applications should be audited for unauthorized access, as compromised ServiceNow instances may have been used to harvest API credentials for downstream systems.

Mitigation & Patching: Step-by-Step Fix

1. Immediate Patch Application (Self-Hosted)

Download and install the July 2026 security patches from the ServiceNow Support Portal:

• Patch KB: KB3137947
• Applicable Releases: All supported releases (Washington DC, Vancouver, Utah, Tokyo, San Diego)
• Installation: Apply via System Upgrade > Upgrade Center. Test in sub-production first.

2. Cloud Instance Verification

Contact ServiceNow support to confirm your instance received the April 2026 mitigations. Request the Guarded Script enforcement status via KB2944435.

3. Guarded Script Enforcement

Enable ServiceNow's new Guarded Script mode, which restricts pre-authentication sandbox contexts to single expressions only—no variable declarations, control flow, function definitions, or assignments. This is configured via:

System Properties > sys_properties > com.glide.script.security.guarded_script = true

4. Network-Level Mitigations

• Restrict inbound access to ServiceNow instances to known IP ranges (corporate VPN, WAF, CDN).
• Block or monitor requests to known pre-auth endpoints: /assessment_thanks.do, /api/now/table/*, /sysparm_* parameters.
• Inspect WAF logs for javascript: payloads in query parameters.

5. Post-Exploitation Detection

If patching was delayed, assume compromise and run these checks:

6. MID Server Audit

Review MID server logs for unexpected SNCProbe or SecurelyAccess invocations. Verify MID server host integrity with endpoint detection tools.

Detection: How to Tell If You're Compromised

Network Indicators

Indicator	Description
javascript: in query parameters	Payloads using the JS injection vector
Requests to /assessment_thanks.do	Primary pre-auth sink documented by Searchlight Cyber
GlideController().evaluateAsObject in POST bodies	Sandbox escape execution primitive
Object.clone / Class.create.constructor in requests	Prototype pollution gadget chain

Log Analysis Queries (Splunk / Elastic)

YARA Rule for Web Shell Detection

Suricata Rule

Sigma Rule

Frequently Asked Questions

Q: Is my SaaS-hosted ServiceNow instance safe? ServiceNow applied mitigations to all cloud instances in April 2026. However, the sandbox escape technique demonstrated by Searchlight Cyber may have alternative gadget chains. Contact ServiceNow support to confirm Guarded Script enforcement is active on your instance (KB2944435).

Q: What if I can't patch immediately? Implement network-level blocking of the assessment_thanks.do endpoint and any pre-auth endpoints accepting sysparm_* parameters. Deploy the Suricata/Sigma rules above for detection. Restrict inbound access to corporate IP ranges only.

Q: Does this affect ServiceNow's ITSM, ITOM, or ITBM modules specifically? The vulnerability is in the core platform's GlideRecord API and script sandbox, which underpins all modules. Any ServiceNow application (ITSM, ITOM, ITBM, CSM, HRSD, GRC, SecOps) running on an unpatched instance is vulnerable.

Q: Has CISA added this to the Known Exploited Vulnerabilities catalog? As of July 27, 2026, CVE-2026-6875 is not yet on the CISA KEV list. Given the confirmed in-the-wild exploitation and critical CVSS 9.8 score, addition is highly probable. Monitor CISA KEV.

Q: Are there any Proof-of-Concept exploits publicly available? Searchlight Cyber published a detailed technical writeup with sandbox escape methodology but did not release a weaponized PoC. The Defused Cyber tweet confirms attackers are using a different gadget chain than the published one, indicating multiple exploitation paths exist.

Q: How does this relate to the previous ServiceNow vulnerability (CVE-2024-XXXX)? This is Searchlight Cyber's second pre-auth RCE in ServiceNow. Their first (Assetnote research) chained three bugs for data access. CVE-2026-6875 achieves full RCE via a novel sandbox escape. Both exploit the GlideRecord API's handling of user-supplied filters.

Q: What is the "Guarded Script" feature and should I enable it? Guarded Script is ServiceNow's new sandbox mode that restricts pre-auth scripts to a single expression—no variables, loops, conditionals, functions, or assignments. It effectively prevents the prototype pollution gadget chain. Enable it immediately via com.glide.script.security.guarded_script = true after testing in sub-production.

Key Takeaways

1. Patch Now: CVE-2026-6875 is a CVSS 9.8 pre-auth RCE with confirmed in-the-wild exploitation. Self-hosted instances must apply the July 13 patches immediately.

2. SaaS Is Not Immune: Cloud instances received April mitigations, but the underlying sandbox architecture may still permit alternative gadget chains. Verify Guarded Script enforcement.

3. MID Servers Extend the Blast Radius: Compromised instances can execute commands on connected MID servers, often inside trusted network segments. Audit MID server logs.

4. Detection Is Critical: Deploy the Suricata, Sigma, and YARA rules above. Monitor for javascript: payloads and the specific gadget chain signatures.

5. Assume Breach If Delayed: If your instance was unpatched between July 13–20, conduct a full compromise assessment: check for unauthorized admins, suspicious business rules, and MID server anomalies.

6. ServiceNow's Transparency Gap: The vendor's advisory still states "no evidence of exploitation" despite Defused Cyber's public confirmation. Security teams should rely on independent threat intelligence, not vendor advisories alone.

---

Sources: BleepingComputer, Searchlight Cyber, Defused Cyber Tweet, ServiceNow KB3137947, NVD CVE-2026-6875