CVE-2026-6875: ServiceNow Sandbox Escape Leads to Pre-Auth RCE in AI Platform

ServiceNow AI Platform (the enterprise PaaS formerly branded in the Now Platform) contains a critical, unauthenticated remote code execution vulnerability tracked as CVE-2026-6875. The vulnerability allows a remote attacker to escape ServiceNow’s JavaScript execution sandbox. No credentials or user interaction are required, and the attacker achieves full code execution on the underlying instance.

ServiceNow deployed mitigations to its cloud-hosted instances within 24 hours of the report and released formal patches for self-hosted/on-premise customers on July 13, 2026. Because the vulnerable code sits in ServiceNow’s core query engine, every self-hosted or partner-hosted instance still on an unpatched release is exposed, regardless of which modules or apps are installed on top. 

On July 18, 2026, researchers observed the first in-the-wild exploitation attempts, five days after patches were released for self-hosted instances.  

ServiceNow’s AI Platform runs an estimated 100 billion workflows a year across roughly 85% of Fortune 500 companies, making this a same-day patch priority for any exposed instance. 

What Is CVE-2026-6875?  

Risk analysis 

CVE-2026-6875 is a sandbox-escape vulnerability affecting ServiceNow’s GlideRecord query engine and script execution environment. ServiceNow exposes a query-filter operator that evaluates attacker-supplied text as JavaScript, and several pre-authentication endpoints pass unauthenticated user input straight into that query engine. What starts as JavaScript execution inside a locked-down sandbox can be escalated, through a script-loading gadget, into fully unsandboxed code execution, equivalent to administrator-level access. 

Root Cause: Improper JavaScript Sandbox Isolation in GlideRecord 

ServiceNow’s GlideRecord API supports a documented “javascript:” filter operator that evaluates user-supplied JavaScript  during query processing. Multiple pre-authication endpoints pass unauthenticated input into this evaluation mechanism. Due to improper isolation of the JavaScript execution environment, an attacker can escape the restricted script sandbox and achieve arbitrary server-side code execution. One notable entry point is /assessment_thanks.do via the sysparm_assessable_type parameter, which provides the initial JavaScript execution foothold. 

That execution is initially contained inside a restrictive additional sandbox that blocks eval, new Function(), and function declarations, and exposes only a narrow allow-list of objects. By itself, not enough for meaningful compromise. 

Root Cause: Escaping the Script Sandbox via gs.include() 

The sandbox has one notable gap: its script-include loader (gs.include()) evaluates library code outside the restrictive sandbox entirely. By overriding frozen global objects with Object.defineProperty, an attacker replaces Object.clone with the Function constructor and a class prototype with attacker-controlled code. This coerces ServiceNow’s own class-extension logic into calling Function(attacker_code) unsandboxed. 

The result is arbitrary, unsandboxed JavaScript execution equivalent to administrative Glide access. This gives full read/write of any table, creation of new administrator accounts, and command execution on any connected MID Server proxies, hosts that commonly sit inside the customer’s internal network. 

Exploitation Flow: From Anonymous Request to Full Instance Compromise 

The attack unfolds in five steps, taking an anonymous request from initial foothold to full instance compromise: 

1. An anonymous attacker sends a crafted request to a pre-auth ServiceNow endpoint such as /assessment_thanks.do, setting a filter parameter to a “javascript:” payload. 
2. ServiceNow evaluates the payload inside its restrictive script sandbox, giving the attacker limited but real JavaScript execution. 
3. The attacker overrides frozen global objects (Object.clone, class prototypes) using Object.defineProperty, setting up a gadget that will run when a script-include library is loaded. 
4. Triggering gs.include() on the targeted library causes ServiceNow’s own class-extension code to invoke the Function constructor on attacker-controlled code, executing it fully outside the sandbox. 
5. With unsandboxed execution, the attacker reads and writes any table, creates administrator accounts, and issues commands to connected MID Server proxies, achieving full instance and potential internal-network compromise. 

Defused’s in-the-wild observations confirm attackers are hitting the same pre-auth sink documented by Searchlight Cyber. However, they are using a different sandbox-escape gadget than the published proof-of-concept, indicating this exploitation flow has more than one viable variant.

Affected ServiceNow Versions and Patch Status 

Self-hosted and partner-hosted instances are the highest priority: they required the July 13, 2026 patch release (KB3137947) to be applied manually and are the instances where Defused has observed active exploitation attempts. 

Mitigation and Remediation Steps for ServiceNow Administrators 

Patching remains the only complete fix, but the following steps close off exposure while updates are rolled out: 

• Patch immediately: apply the July 13, 2026 security update per KB3137947 on all self-hosted and partner-hosted instances. 

• Verify cloud instances: ServiceNow-hosted customers should confirm their instance reflects the April 2026 mitigation and current patch level with ServiceNow support if uncertain. 

• Block at the edge if patching is delayed: filter or block requests containing the “javascript:” scheme in query parameters routed to GlideRecord-backed endpoints, particularly /assessment_thanks.do and other pre-auth .do endpoints accepting sysparm_* filter values. 

• Hunt for compromise: review logs for “javascript:” in request parameters to pre-auth endpoints, audit sys_user for unexpected administrator accounts, and check MID Server logs for anomalous outbound commands. 

• Segment MID Servers: limit the internal network access granted to MID Server proxies to reduce blast radius if an instance is compromised. 

• Track new gadget chains: re-verify patch status regularly; at least two distinct exploitation gadget chains are now known for this flaw. 

AppTrana WAAP Coverage for CVE-2026-6875 

AppTrana customers are protected against exploitation attempts targeting this vulnerability. Edge-level virtual patching blocks “javascript:” filter-injection payloads to GlideRecord-backed endpoints, including /assessment_thanks.do, before they reach the application, regardless of the ServiceNow release running underneath. 

AppTrana WAAP blocks a CVE-2026-6875 exploit attempt on /assessment_thanks.do, the malicious payload is rejected with a 406 Not Acceptable before it reaches ServiceNow.