ServiceNow's AI Platform Under Fire: How CVE-2026-6875 Became an Active Exploitation Target

ServiceNow's AI Platform Under Fire

Here's the thing about enterprise platforms that nobody wants to hear: when you're running 100 billion workflows a year across 85% of the Fortune 500, every unauthenticated endpoint is a door someone's trying to kick in.

That's exactly where ServiceNow finds itself right now. Threat intelligence firm Defused confirmed over the weekend of July 19–20, 2026 that attackers are actively exploiting CVE-2026-6875 — a critical sandbox-escape remote code execution flaw in ServiceNow's AI Platform. The first attempts were spotted on Friday, July 18.

What makes this particularly nasty isn't just the CVSS score of 9.5. It's that attackers have figured out a way to reach code execution through a different gadget path than the proof-of-concept published by Searchlight Cyber, the firm that discovered and reported the flaw on April 1. The sink is the same — /assessment_thanks.do — but the route to exploitation has evolved. That means defenders who were only watching for the published PoC pattern? They missed it.

ServiceNow's official advisory still reads like it was written before the weekend: "not currently aware of exploitation against ServiceNow instances." A spokesperson told BleepingComputer they'd seen no evidence tied to ServiceNow-hosted instances, but the company is urgently pushing both hosted and self-hosted customers to apply patches.

This isn't just another CVE. It's a case study in how quickly the window between disclosure and active exploitation can collapse — and why artificial intelligence cybersecurity threats targeting enterprise platforms demand a different kind of response.

The Technical Profile of CVE-2026-6875

Let's get into the weeds, because understanding what this vulnerability actually does matters if you're responsible for patching anything on the ServiceNow platform.

CVE-2026-6875 is classified as CWE-94 — Improper Control of Generation of Code, commonly known as code injection. The CVSS 4.0 vector string from ServiceNow's CNA assessment is brutal: AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Breaking that down for the non-metrics-nerds in the room:

• Attack Vector: Network — you don't need physical access or a USB stick. This is remote.
• Attack Complexity: High — this isn't a one-liner. Attackers need to craft sophisticated payloads.
• Attack Requirements: None — no prerequisites. No social engineering. No user interaction.
• Privileges Required: None — unauthenticated. That's the killer.
• User Interaction: None — again, no one needs to click anything.
• Confidentiality/Integrity/Availability Impact: High across both the compromised component and surrounding system.

The "high complexity" rating is what makes this one interesting from a threat modeling perspective. Yes, it's harder to exploit than a trivial buffer overflow. But when you're targeting Fortune 500 enterprises with potentially millions of instances, even a high-complexity attack at scale is devastating. And the fact that attackers have already found a working gadget path means that complexity barrier has been cleared.

CISA-ADP assessed this vulnerability on July 13, 2026 with an SSVC rating of exploitation=none, automatable=no, technicalImpact=total. That "technical impact: total" designation is worth sitting with. It means if an attacker gets in, they're not just reading a file — they own the platform.

The affected versions list is comprehensive: everything prior to Australia Patch 2, Yokohama Patch 12 Hot Fix 1b, Yokohama Patch 13, Zurich Patch 7b, Zurich Patch 9, Brazil EA, and Brazil GA. If you're running anything older than those patches, you're exposed.

The Defused Disclosure: A Different Gadget Path

Defused's Saturday tweet dropped some serious context that most coverage is still missing:

"We are observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875). The payloads hit the same pre-auth sink @SLCyberSec documented (/assessment_thanks.do), but the sandbox-escape gadget reaches the same code-execution primitive by a different route than their published PoC."

Let me unpack why this matters more than most headlines suggest.

Searchlight Cyber (now referenced as @SLCyberSec) published their proof-of-concept back in April. Security teams spent the intervening months building detection rules around that specific gadget chain. Defused is saying attackers have moved on — they're hitting the same endpoint, but through a completely different exploitation path.

This is textbook exploit evolution. When you publish a PoC, you give defenders a target. Sophisticated threat actors don't just ignore your publication — they study it, then find a path around it. The sink stays the same because that's where the code execution happens. But the gadget chain leading to it? That's changed.

What this means in practice: if your SIEM is only alerting on the Searchlight Cyber PoC pattern, you're blind to what's actually happening right now. You need detection rules that look for the broader behavior — unauthenticated requests to /assessment_thanks.do with suspicious payload characteristics, regardless of the specific gadget chain used.

The timeline here is also worth noting. Searchlight disclosed on April 1. ServiceNow patched hosted instances in April. Self-hosted patches dropped July 13. First exploitation observed Friday, July 18 — just five days after the self-hosted patch became available. That's a remarkably tight window between patch release and active weaponization.

ServiceNow's Response and the Hosted vs. Self-Hosted Divide

ServiceNow's statement to BleepingComputer is worth reading carefully:

"ServiceNow is aware of a cybersecurity company's recent publication regarding exploitation activity associated with a previously disclosed security vulnerability, identified as CVE-2026-6875. Based on our investigation to date, we have not observed evidence that this activity is related to instances that ServiceNow hosts."

There's a meaningful distinction being drawn here between hosted and self-hosted instances. ServiceNow hosts the platform for thousands of enterprises — those are their managed environments. Self-hosted deployments run on customer infrastructure, which means patching timelines depend entirely on the customer's internal processes.

Here's the uncomfortable reality: ServiceNow patched their hosted instances back in April. But self-hosted customers only got their patches on July 13. That three-month gap? That's where the exploitation is happening. Self-hosted customers who haven't applied the July 13 patch are sitting targets.

ServiceNow's spokesperson added: "We have provided updates and patches designed to address this issue, and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so. In addition, we will continue to work directly with customers who need assistance in applying the patches."

Translation: we've done our part. Now it's on you to patch.

This dynamic — where the vendor patches quickly but enterprise customers lag — is why vulnerability management programs exist. And it's why this particular flaw is so dangerous: the hosted instances are protected, but the self-hosted population (which includes many large enterprises with complex deployment architectures) is still vulnerable.

ServiceNow also notes they're running over 100 billion workflows annually across 100,000+ enterprise AI applications. That's not just scale — that's critical infrastructure. Every compromised instance potentially affects HR systems, IT service management, customer relationship data, and more.

What This Means for AI Agent Security Postures

Let's zoom out for a moment. The ServiceNow AI Platform isn't just an enterprise workflow tool — it's becoming the backbone for AI agent deployments across large organizations. When you're running 100,000 enterprise AI apps, those aren't just chatbots. They're autonomous agents handling ticket resolution, security monitoring, compliance workflows, and data processing.

CVE-2026-6875 represents a direct threat to that entire ecosystem. An unauthenticated RCE into the platform doesn't just compromise one application — it compromises the runtime environment that all those AI agents depend on.

From an artificial intelligence cybersecurity threats perspective, this vulnerability highlights several critical concerns:

Agent supply chain risk. When AI agents run on a shared platform, compromising that platform compromises every agent. There's no isolation at the application layer if the underlying runtime is owned.

Autonomous agent trust boundaries. Many of these AI agents operate with elevated privileges because they need to interact with enterprise systems. If an attacker gains code execution on the platform, those agent credentials become attack vectors for lateral movement.

Multi-agent coordination vulnerabilities. As organizations deploy multi-agent systems that coordinate across different functions, a single platform compromise can cascade through what should be independent agent workflows.

The Securing AI Agent Practices community has been emphasizing exactly this kind of platform-level threat modeling. The ServiceNow situation is a real-world demonstration of why agent security can't stop at the application boundary.

For organizations running ServiceNow, the immediate action items are clear:

1. Verify your patch level against the affected versions list
2. Implement network-level controls to restrict access to /assessment_thanks.do from unauthenticated sources
3. Monitor for anomalous requests to that endpoint, regardless of the specific payload pattern
4. Review agent privilege assignments — assume the platform runtime may be compromised until patched

The Broader Context: ServiceNow's Security Track Record

This isn't ServiceNow's first encounter with active exploitation of a critical vulnerability. Just last month, the company privately disclosed a security incident where attackers queried data from customer instances by exploiting an unauthenticated access flaw via a vulnerable API endpoint.

That incident was tied to security researchers or customer-led research linked to bug bounty submissions rather than malicious threat actors — but the pattern is concerning. Two critical vulnerabilities in rapid succession, one of which is now being actively exploited in the wild.

The ServiceNow platform's attack surface is enormous. With 100,000+ enterprise applications running on it, every custom integration, every API endpoint, and every plugin represents a potential entry point. The /assessment_thanks.do sink that CVE-2026-6875 targets is just one of thousands of endpoints that need continuous security monitoring.

This context matters because it shapes how we should think about artificial intelligence cybersecurity threats targeting enterprise platforms. It's not an isolated incident — it's part of a broader pattern where the complexity and scale of modern enterprise platforms creates persistent attack opportunities.

The good news: ServiceNow has a robust vulnerability management program. They disclosed CVE-2026-6875 to CISA-ADP on July 13, provided patches within days, and are actively communicating with customers. The bad news: the self-hosted patch timeline created a window that threat actors exploited within days of release.

For security teams, the takeaway is straightforward but urgent: patch immediately if you're on a self-hosted deployment and haven't applied the July 13 updates. Then implement compensating controls — network segmentation, WAF rules, endpoint detection — because you can't always patch fast enough to stay ahead of active exploitation.