7 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-6875 is a critical sandbox escape vulnerability in the ServiceNow AI Platform that is being actively exploited in the wild. The flaw allows unauthenticated attackers to bypass scripting restrictions and execute code with broader platform privileges, potentially leading to administrative account creation, unauthorized access to platform data, and abuse of connected MID Servers. Organizations should immediately verify that all ServiceNow instances have received the appropriate security updates and investigate for signs of compromise.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
ServiceNow AI Platform Sandbox Escape Vulnerability
Identifier: CVE-2026-6875
PoC or Exploitation: CVE-2026-6875 is being actively exploited in the wild.
CVSS Score: 9.5 (Critical, CVSS v4.0)
Update / Patch: ServiceNow deployed security updates to hosted instances and provided relevant updates to self-hosted customers and partners.
Affected and fixed release boundaries:
Australia:
Affected: Versions earlier than Australia Patch 2
Fixed: Australia Patch 2 or later
Yokohama:
Affected: Versions earlier than Yokohama Patch 12 Hot Fix 1b in the applicable maintenance stream
Fixed: Yokohama Patch 12 Hot Fix 1b or later
Affected: Versions earlier than Yokohama Patch 13 in the applicable maintenance stream
Fixed: Yokohama Patch 13 or later
Zurich:
Affected: Versions earlier than Zurich Patch 7b in the applicable maintenance stream
Fixed: Zurich Patch 7b or later
Affected: Versions earlier than Zurich Patch 9 in the applicable maintenance stream
Fixed: Zurich Patch 9 or later
Brazil:
Affected: Versions earlier than Brazil EA in the applicable release stream
Fixed: Brazil EA or later
Affected: Versions earlier than Brazil GA in the applicable release stream
Fixed: Brazil GA or later
ServiceNow advisory and update guidance:
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
Description:
CVE-2026-6875 is a sandbox-escape vulnerability in the ServiceNow AI Platform.
The vulnerability permits attacker-controlled JavaScript supplied through affected platform functionality to execute inside a restricted script sandbox. An unauthenticated attacker can use a sequence of scripting operations to escape those restrictions and execute code with broader ServiceNow platform capabilities.
Successful exploitation can allow access to platform data, creation of administrative users, and execution of commands through connected ServiceNow MID Servers.
Mitigation Recommendation:
Immediately verify that every ServiceNow AI Platform instance has received the applicable security update.
Review unauthenticated requests to /assessment_thanks.do, particularly requests containing the sysparm_assessable_type parameter and javascript: expressions.
Review platform audit records for unexpected administrative-account creation, unauthorized table access, script execution, configuration changes, API activity, and suspicious modifications to workflows or integrations.
Inspect connected MID Servers for unexpected commands, processes, network connections, or other evidence of execution originating from ServiceNow.
