The Clock Started Ticking the Day It Was Reported
Here's what keeps me up: a critical vulnerability in an enterprise platform used by 85% of Fortune 500 companies was reported to the vendor on April 1, 2026. Patches hit hosted instances the next day. Self-hosted customers got their updates throughout June.
And yet, by July 18 — roughly twelve weeks later — threat actors were already firing exploits against it in the wild.
CVE-2026-6875 is a code injection flaw (CWE-94) in the ServiceNow AI Platform, formerly known as the Now Platform. It lets an unauthenticated attacker escape the platform's script sandbox and execute arbitrary code remotely. The CVSS 4.0 base score is a flat 9.5 — Critical, with no privileges required, no user interaction needed, and full impact across confidentiality, integrity, and availability for both the platform and any connected proxy servers.
Searchlight Cyber's Adam Kues documented the flaw in a technical research post, and Defused Security confirmed over the weekend of July 19–20 that exploitation was actively happening. The first attempts appeared on Friday, July 18.
This is exactly the kind of AI cybersecurity threat pattern we've been warning about: a high-severity flaw in critical enterprise infrastructure, weaponized faster than most security teams can finish their patch management cycle.
How the Exploit Actually Works
Let's get technical for a minute, because understanding the mechanism matters if you're responsible for keeping your instance secure.
The vulnerability lives in the /assessment_thanks.do endpoint — a pre-authentication sink that Searchlight Cyber identified as the attack surface. An attacker doesn't need credentials. They don't need to trick a user into clicking anything. They just need network access to the ServiceNow instance.
Here's where it gets interesting, though. The sandbox-escape gadget that Defused observed in the wild reaches the same code-execution primitive as Searchlight Cyber's published proof-of-concept — but it takes a different route through the platform's internals. The published PoC used one gadget chain. The attackers are using another.
That matters. A lot.
When researchers publish a PoC, defenders focus their detection engineering on that specific chain. Attackers who find an alternative path through the same vulnerability effectively go invisible to signature-based detections tuned to the original exploit. It's like publishing a blueprint for breaking into a house, and then someone else finds the unlocked basement window you never mentioned.
ServiceNow's July 13 security updates include a new feature called Guarded Script, which restricts the types of code that can execute within sandbox contexts. Think of it as adding a second lock on the basement window — it doesn't fix the original door, but it raises the bar for anyone trying to get in through similar routes.
The Timeline: Twelve Weeks From Disclosure to Weaponization
Let me lay out the chronology, because it tells you everything about how fast these threats move:
April 1, 2026 — Searchlight Cyber reports CVE-2026-6875 to ServiceNow. The vulnerability allows unauthenticated sandbox escape and remote code execution.
April 2, 2026 — ServiceNow deploys a security update to hosted instances. If you're on ServiceNow's cloud platform, you're patched.
June 2026 — Patches and security updates are made available to self-hosted customers and partners. This is the group that's now in the crosshairs.
July 13, 2026 — Public disclosure. The CVE is published to NVD with a CVSS 9.5 rating. ServiceNow releases security updates for all affected platform families. CISA-ADP assesses the SSVC profile: exploitation=none (at that point), automatable=no, technicalImpact=total.
July 13–18 — Searchlight Cyber publishes its technical deep-dive. The security community digests the details.
Friday, July 18 — First exploitation attempts observed in the wild.
Saturday–Sunday, July 19–20 — Defused Security confirms active in-the-wild exploitation. The gadget chain differs from the published PoC.
July 20 — ServiceNow issues a statement confirming awareness of exploitation activity but stating it has not observed evidence related to hosted instances.
Twelve weeks. From responsible disclosure to active weaponization. And the self-hosted customers who hadn't patched in June? They're the ones getting hit.
Who's Actually at Risk
Let's talk numbers, because they're sobering.
ServiceNow's AI Platform runs more than 100 billion workflows per year. It powers over 100,000 enterprise AI applications. And it's deployed at 85% of Fortune 500 companies.
That means a successful exploit doesn't just compromise one organization. It compromises the backbone of enterprise workflow automation — HR systems, IT service management, customer relationship platforms, financial workflows. All of it.
The primary risk group is clear: self-hosted ServiceNow customers who haven't applied the July 13 patches. If you're running your own instances on Australia, Yokohama, Zurich, or Brazil platform releases and you haven't updated, you're exposed. Specifically:
- Australia instances below Patch 2
- Yokohama instances below Patch 12 Hot Fix 1b or Patch 13
- Zurich instances below Patch 7b or Patch 9
- Brazil instances below Early Access or General Availability
Hosted (cloud) customers were patched on April 2 and are not currently affected, according to ServiceNow. But don't let that lull you into complacency — the hosted platform is a massive attack surface, and this incident shows how quickly vulnerabilities in shared infrastructure can become a multi-tenant crisis.
What You Need to Do Right Now
If you manage a ServiceNow instance, here's your checklist. Not tomorrow. Today.
1. Verify patch status immediately. Check your platform release and patch level against the affected versions above. If you're unpatched, apply the update now.
2. Review your audit logs. Look for anomalous activity on the /assessment_thanks.do endpoint and other pre-authentication surfaces. Unusual POST requests from external IPs should trigger an investigation.
3. Enable Guarded Script. If your patch includes this feature, turn it on. It restricts which code types can execute in sandbox contexts and reduces the likelihood of future sandbox-escape attacks succeeding.
4. Audit connected proxy servers. The vulnerability compromises not just the ServiceNow instance but any proxy servers connected to it. If your instance is integrated with other systems, those systems are potentially in scope.
5. Assume detection gaps. The attackers used a different gadget chain than the published PoC. That means any detection rules built around Searchlight Cyber's research may have missed what's actually happening in your environment. Test your defenses.
The Bigger Pattern: Enterprise Platforms Keep Getting Hit
This isn't the first time ServiceNow has been in the news for a security failure. Just last month, the company disclosed a separate incident where attackers queried customer data through an unauthenticated API endpoint — a flaw that existed for years and was only patched after six weeks of silence following a bug bounty submission.
That incident is covered in our earlier reporting on ServiceNow's unauthenticated API endpoint exposure.
The pattern is unmistakable: enterprise workflow platforms are high-value targets precisely because they sit at the center of organizational operations. Compromise one ServiceNow instance, and you potentially compromise a significant slice of an enterprise's digital infrastructure. AI-powered automation makes these platforms even more attractive — they hold the keys to autonomous workflows, agent-driven processes, and multi-agent orchestration systems that organizations are increasingly dependent on.
The AI cybersecurity threats landscape is evolving fast. Nation-state actors, organized crime groups, and opportunistic threat actors are all targeting the same infrastructure. The question isn't whether your platform will be targeted. It's whether you'll be patched in time.
Bottom Line
CVE-2026-6875 is a reminder that in enterprise software, the gap between disclosure and exploitation is shrinking. Twelve weeks might sound like a long time. In threat intelligence terms, it's an eternity.
ServiceNow has done the right thing by patching hosted instances quickly and releasing updates to self-hosted customers. But the fact that attackers found an alternative gadget chain within days of public disclosure tells you something about the sophistication level we're dealing with.
Secure your instances. Test your detections. And don't wait for the next CVE to remind you that defense in depth isn't optional.
Sources: BleepingComputer, NVD (CVE-2026-6875), Help Net Security
