CVE-2026-6875: ServiceNow AI Platform Sandbox Escape - What It Means for Your Business and How to Respond

Introduction

A critical vulnerability in the ServiceNow AI Platform has drawn attention across North American enterprises that rely on the platform for core operations, workflow automation, and data management. CVE-2026-6875 allows an unauthenticated attacker, under certain conditions, to execute code inside a vulnerable instance. Organizations using ServiceNow for IT service management, customer workflows, human resources, or security operations face potential disruption to daily processes, exposure of sensitive business data, and downstream effects on connected systems.

This post explains why the issue matters to business leaders and decision-makers in the United States and Canada, outlines the practical risks to operations and compliance, provides real-world impact scenarios, and offers a clear checklist to determine whether your organization is exposed. It also covers the essential steps to reduce risk and points to professional support for deeper assurance. Technical details appear only in the appendix for security and IT teams.

S1 — Background & History

ServiceNow disclosed CVE-2026-6875 on July 13, 2026. The vulnerability affects the ServiceNow AI Platform and enables remote code execution through a sandbox escape. Searchlight Cyber researchers identified and reported the issue to ServiceNow on April 1, 2026. The vendor assigned a CVSS 4.0 score of 9.5, rated Critical.

In plain language, the flaw lets an unauthenticated user run code inside the platform under specific circumstances. ServiceNow deployed a security update to its hosted instances shortly after the initial report and later released patches and family updates for self-hosted customers and partners. Affected releases include versions prior to Australia Patch 2, Yokohama Patch 12 Hot Fix 1b and Patch 13, Zurich Patch 7b and Patch 9, and Brazil EA/GA. ServiceNow has stated it is not currently aware of exploitation against the instances it hosts, though independent reports have described exploitation activity against some environments after public disclosure. Customers were urged to apply the available updates promptly.

S2 — What This Means for Your Business

For organizations that depend on ServiceNow, this vulnerability translates into concrete business risk rather than an abstract technical problem. An attacker who successfully exploits the flaw can gain control of the platform instance. That control can interrupt automated workflows that keep operations running, from incident response and change management to customer service and employee onboarding.

Sensitive data stored or processed in ServiceNow tables becomes accessible. Customer records, employee information, financial details, and internal process data can be read, altered, or exfiltrated. Reputation damage follows quickly when a widely used enterprise platform is compromised, especially if the incident becomes public or affects customers and partners.

Regulatory exposure is also real. Organizations subject to data-protection rules in the United States and Canada, including sector-specific requirements for financial services, healthcare, and government contractors, may face notification obligations, audits, or enforcement action if personal or regulated data is involved. Even without a confirmed breach, the need to investigate, contain, and remediate can divert leadership attention and consume resources that would otherwise support growth or customer delivery. The combination of operational disruption, data risk, reputational harm, and compliance pressure makes timely verification and remediation a business priority.

S3 — Real-World Examples

Regional Bank Operations Disruption: A mid-sized regional bank uses ServiceNow to manage IT incidents, change requests, and customer-facing service workflows. An unauthenticated attacker reaches the vulnerable instance and gains code execution. Core service-management processes stall while the bank investigates, creating delays in customer support and internal IT response. Regulatory scrutiny follows because the platform holds customer and transaction-related data.

Healthcare Provider Data Exposure: A multi-site healthcare system relies on ServiceNow for employee onboarding, asset tracking, and clinical support workflows. Successful exploitation allows access to tables containing workforce and operational data. Leadership must assess whether protected health information or other regulated records were exposed, triggering internal review, potential patient notification considerations, and coordination with privacy and compliance teams.

National Retailer Supply-Chain Impact: A large retailer runs ServiceNow for vendor management, inventory-related workflows, and store operations support. An attacker creates privileged accounts and reaches connected proxy systems that sit inside the corporate network. Fulfillment and logistics processes experience interruptions, and the retailer faces both operational recovery costs and questions from partners about the security of shared processes.

Public-Sector Agency Continuity Risk: A provincial or state agency uses ServiceNow for citizen service requests and internal case management. Code execution on the instance threatens continuity of public-facing services and raises concerns about integrity of case data. Leadership must balance rapid remediation against the need to maintain essential services while confirming the scope of any unauthorized activity.

S4 — Am I Affected?

• You operate a ServiceNow instance (hosted by ServiceNow or self-hosted) on a release family prior to the fixed patches listed by the vendor.
• Your instance runs a version earlier than Australia Patch 2, Yokohama Patch 12 Hot Fix 1b or Patch 13, Zurich Patch 7b or Patch 9, or Brazil EA/GA.
• You have not yet confirmed that the official ServiceNow security update or the corresponding family patch has been applied to every relevant instance.
• Your organization uses ServiceNow AI Platform capabilities that process unauthenticated or publicly reachable endpoints related to assessments or similar functionality.
• You maintain self-hosted or partner-managed instances and have not verified patch status through official ServiceNow channels or release notes.
• Connected MID servers or proxy systems that interact with the ServiceNow instance have not been reviewed for signs of unauthorized activity following any potential exposure window.

Key Takeaways

• CVE-2026-6875 is a critical vulnerability that can allow unauthenticated code execution on affected ServiceNow AI Platform instances and therefore carries direct operational, data, and compliance risk.
• Business impact centers on disrupted workflows, potential exposure of sensitive records, reputational harm, and regulatory obligations rather than purely technical details.
• Organizations across banking, healthcare, retail, and public-sector environments face realistic scenarios in which exploitation could interrupt services or require costly investigation and recovery.
• Determining exposure requires checking ServiceNow version and patch status against the official fixed releases and confirming that hosted or self-hosted instances have received the vendor updates.
• Prompt verification and remediation, supported by professional assessment where needed, reduce the window of risk and support continued reliable use of the platform.

Call to Action

Confirm your ServiceNow environment is running a patched release and that no residual exposure remains. For organizations that need independent validation of their ServiceNow security posture, broader attack-surface reduction, or a full penetration test that includes platform-specific risks, contact IntegSec. Our team delivers practical, business-focused assessments that help you identify gaps and strengthen defenses. Visit https://integsec.com to start the conversation and schedule a consultation.

TECHNICAL APPENDIX (security engineers, pentesters, IT professionals only)

A — Technical Analysis

CVE-2026-6875 is a sandbox-escape vulnerability that results in unauthenticated remote code execution on the ServiceNow AI Platform. The root cause lies in the handling of the sysparm_assessable_type parameter on the /assessment_thanks.do endpoint. That parameter is passed into GlideRecord’s addQuery() method, which evaluates values prefixed with javascript: inside a restricted script sandbox.

Attackers can use a gadget chain involving Object.defineProperty and Class.create.constructor, combined with gs.include('ItemViewElementsProvider'), to escape the sandbox and invoke Function(code)() in a less-restricted context. The attack vector is network-accessible and requires no privileges or user interaction. Attack complexity is rated high. The official CVSS 4.0 vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. The issue is classified under CWE-94 (Improper Control of Generation of Code). Further details appear in the NVD entry for CVE-2026-6875 and ServiceNow’s advisory KB3137947.

B — Detection & Verification

Version enumeration can be performed by reviewing the instance’s release and patch level through the ServiceNow administrative interface or by querying the relevant system tables and comparing against the fixed versions (Australia Patch 2, Yokohama Patch 12 Hot Fix 1b / Patch 13, Zurich Patch 7b / 9, Brazil EA/GA).

Scanner signatures and Nuclei templates targeting the /assessment_thanks.do endpoint with crafted sysparm_assessable_type values that attempt sandbox-escape patterns are available. Log indicators include unusual requests to /assessment_thanks.do containing javascript: prefixes or anomalous parameters, followed by unexpected script execution or elevated activity. Behavioral anomalies may include sudden creation of administrator accounts, unexpected table queries, or command execution on associated MID servers. Network indicators include inbound traffic to the assessment endpoint from untrusted sources and subsequent outbound connections or process activity originating from the ServiceNow application tier or proxy servers.

C — Mitigation & Remediation

1. Immediate (0–24h): Apply the official ServiceNow security update or the corresponding family patch for the installed release. For ServiceNow-hosted instances, confirm that the vendor-deployed update is active. Restrict network access to the instance where feasible and monitor the /assessment_thanks.do endpoint for anomalous traffic.
2. Short-term (1–7d): Verify patch application across all instances, including any development, test, and production environments. Review logs for signs of prior exploitation, check for unauthorized administrator accounts, and examine connected MID servers for unexpected processes or configurations. Implement interim network controls or web-application firewall rules that block suspicious parameter patterns on the assessment endpoint if full patching cannot be completed immediately.
3. Long-term (ongoing): Maintain a disciplined patch-management process aligned with ServiceNow’s release and security-update cadence. Restrict the types of code permitted in sandbox contexts according to ServiceNow’s Guarded Script guidance. Conduct regular configuration reviews and penetration tests that include platform-specific attack surfaces. Official vendor patches remain the primary remediation; interim mitigations should be treated as temporary bridges only.

D — Best Practices

• Limit unauthenticated access to any ServiceNow endpoints that accept parameters capable of triggering script evaluation, and enforce network segmentation around the platform.
• Adopt and enforce ServiceNow’s Guarded Script restrictions so that sandbox contexts accept only simple, non-executable expressions.
• Maintain continuous visibility into instance version and patch status, and treat self-hosted environments with the same urgency as cloud instances.
• Monitor for anomalous account creation, elevated privilege changes, and unusual activity on MID servers that may indicate post-exploitation.
• Integrate ServiceNow-specific checks into regular vulnerability management and penetration-testing programs so that sandbox and script-execution surfaces receive focused attention.