ServiceNow CVE-2026-6875 attacks reported

A critical ServiceNow AI Platform vulnerability has crossed the line from public research into reported attack traffic. On 20 July, new reporting cited Defused telemetry showing in-the-wild attempts against CVE-2026-6875, a pre-authentication sandbox escape that can lead to remote code execution.

There is an important qualification. ServiceNow's published CVE record says the company is not currently aware of exploitation against ServiceNow instances. In an updated statement, the company said it had not observed evidence that the reported activity was related to instances it hosts. Independent telemetry and vendor-hosted telemetry are different scopes, so defenders should preserve both facts instead of flattening them into a false certainty.

What CVE-2026-6875 makes possible

ServiceNow describes the flaw as a remote code-execution vulnerability in the ServiceNow AI Platform that can, in certain circumstances, allow an unauthenticated user to execute code. The CVE uses a CVSS 4.0 vector with high attack complexity, no required privileges, no user interaction, and high impact across confidentiality, integrity, and availability.

Searchlight Cyber's technical analysis traces the route from attacker- controlled input in a pre-authentication query path to JavaScript evaluation inside ServiceNow's restricted scripting environment. The researchers then found a way out of that additional sandbox. They report that successful execution in the broader platform context can expose tables, enable creation of administrative users, and reach configured MID servers that commonly connect ServiceNow to internal networks.

That last point changes the blast-radius calculation. The target is not only a public web application. ServiceNow often brokers workflows across identity, IT support, HR, security operations, cloud platforms, and internal infrastructure. A compromised integration tier may offer both sensitive data and paths into systems that are not directly internet- facing.

The affected release families

The vendor-supplied CVE data identifies affected versions in the Australia, Yokohama, Zurich, and Brazil families and lists patched release thresholds for each branch. ServiceNow says it deployed a security update to hosted instances and provided relevant updates to self-hosted customers and partners. The Canadian Centre for Cyber Security separately advised administrators to apply the necessary updates.

Use ServiceNow's authenticated support article KB3137947 as the source of truth for the correct target build. Do not copy a minimum version from a news article into a change ticket without checking the instance's family, hot-fix track, and current vendor guidance.

Why “patch now” is only the first half

Defused reported that the observed payloads reached the same pre-auth sink documented by Searchlight Cyber but used a different route to the code-execution primitive than the published proof of concept. That means a detection rule built only around the public exploit can produce dangerous confidence.

Establish hosting and ownership. Separate ServiceNow- hosted instances, self-hosted deployments, partner-operated systems, non-production clones, and internet-exposed development instances.
Confirm the patch state with evidence. Record the instance family and build, the vendor-confirmed remediation, deployment time, and any compensating controls used before the patch landed.
Preserve relevant logs. Retain web, platform, audit, authentication, administrative, MID Server, proxy, and network telemetry covering the vulnerable window before normal retention removes it.
Hunt beyond one payload. Review unusual access to the affected pre-authentication path, unexpected query parameters or error patterns, new or changed administrators, anomalous table access, integration changes, and outbound activity from MID Servers.
Contain before rotating trust. If compromise is found or cannot be reasonably excluded, isolate affected components and then replace API tokens, service-account passwords, OAuth material, certificates, and integration secrets from a clean environment.

Support workflows are high-value data stores

Ticketing and workflow systems accumulate screenshots, configuration exports, credentials, personal data, and privileged integration context. The recent EY support-platform breach is a separate incident, but it illustrates the same structural risk: a system labelled “support” may quietly become an archive of everything users needed help with.

Reduce that reservoir before the next vulnerability. Remove credentials from historical tickets where retention is not required, give integrations narrowly scoped identities, and move necessary secret exchange into encrypted, expiring workflows rather than permanent ticket comments.

The EU reporting lens

For organisations and services in scope of NIS2, a confirmed compromise can become a regulatory workflow as well as a technical one. Article 23 establishes staged notification for significant incidents, including an early warning within 24 hours and an incident notification within 72 hours. Applicability and the competent authority depend on the entity, impact, sector, and national transposition, so legal and incident-response owners should make that decision together rather than waiting for the forensic investigation to finish.