ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI…

CVE-2026-6875 is a sandbox escape in the ServiceNow AI Platform that lets an unauthenticated attacker hit /assessment_thanks.do, feed attacker-controlled input into the platform's Rhino-based scripting sandbox, and break out to full server-side code execution. Searchlight Cyber's writeup walks the primitive from sink to Rhino to reading arbitrary tables, minting admin users, and executing shell commands on any connected MID Server proxy. Affected: all ServiceNow AI Platform releases prior to the July 2026 hotfixes rolled into the Xanadu, Yokohama, and Zurich family patches distributed via KB3137947. Hosted (service-now.com) instances were auto-patched by ServiceNow in April 2026; self-hosted / partner / GovCommunityCloud deployments are the exposed population.

There is no NVD CVSS baseline yet, but the vendor's CVSS 4.0 vector scores this at 9.5. Reality matches: unauthenticated, network-reachable, pre-auth code execution on a system that holds ITSM tickets, CMDB, HR, GRC, IRM, and — via MID Server — a foothold into the internal network. This is a first-assessment CRITICAL by every meaningful metric.

Why this verdict

• Zero preconditions: Pre-authentication, single HTTP request to /assessment_thanks.do, no user interaction. Friction audit: unauthenticated remote → attacker population = the internet.
• Active exploitation confirmed by Defused on 2026-07-19, with a gadget chain distinct from the public PoC — meaning multiple actors are working the class, not just replaying one script.
• Role multiplier: ServiceNow is by definition a high-value-role component — it is the enterprise system of record for ITSM, CMDB, HR, GRC, and stores integration credentials for AD, vCenter, cloud, and SCCM. The chain succeeds end-to-end: pre-auth → RCE → admin creation → credential exfil → MID Server pivot into the internal LAN. Blast radius = fleet compromise. Floor = CRITICAL.
• Installed base: ServiceNow is deployed in >80% of the Fortune 500; self-hosted and partner instances that missed the June rollout are the exposed population, but that population is measured in thousands of enterprises, not a rounding error.
• PoC quality: Public write-up + working exploit + a second in-the-wild variant means detection based on one signature will miss.

Why not higher?

CRITICAL / 9.6 is already at the top of the scale for this bug class. The residual 0.4 accounts for the fact that ServiceNow hosted the majority of tenants and patched them in April — the effective exposed population is self-hosted, partner, and GovCommunityCloud, which is smaller than the total ServiceNow install base.

Why not lower?

A HIGH rating would require meaningful friction — authentication, user interaction, or a narrow deployment role. None apply: it is pre-auth, single-shot, in a canonically high-value component, and being exploited today. Downgrading past the role floor is not defensible.

1. Block /assessment_thanks.do at the edge — Add a WAF/ingress rule dropping any request to assessment_thanks.do unless the source is a known-good corporate range. Deploy within 3 days per the noisgate mitigation SLA. This is a legacy assessment endpoint most tenants do not need externally.
2. Push the KB3137947 hotfix to every self-hosted / partner instance — Coordinate with ServiceNow customer support / your partner AM to confirm the exact hotfix build for your release family (Xanadu / Yokohama / Zurich) and roll it during the next change window inside the 3-day mitigation window.
3. Rotate all secrets stored in sys_credentials — Assume compromise on any unpatched instance with recent external exposure. Rotate AD service accounts, cloud API keys, SSH keys, and integration tokens the MID Server can reach. Do this in parallel with patching, not after.
4. Audit sys_user_role and sys_user for new admin accounts — The confirmed post-exploit action is creating admins. Diff the admin list against a known-good snapshot from before 2026-07-13 and pull audit logs for the endpoint.
5. Constrain MID Server service accounts — The MID Server is the pivot into your LAN. Confirm it runs with least-privilege AD/domain rights and cannot reach Tier-0 assets — a policy fix that also blunts the next ServiceNow RCE.

Run this from an auditor workstation with network reachability to the target ServiceNow instance. Invoke as ./check-cve-2026-6875.sh https://your-instance.service-now.com. No privileges required — this is an unauthenticated probe against a public endpoint header/behavior, not the exploit itself.

#!/usr/bin/env bash
# noisgate check for CVE-2026-6875 (ServiceNow AI Platform sandbox escape RCE)
# SAFE: probes only, does NOT execute the sandbox escape.
set -u

if [ $# -ne 1 ]; then
  echo "Usage: $0 https://<instance>.service-now.com" >&2
  exit 2
fi

TARGET="${1%/}"
UA="noisgate-cve-2026-6875-check/1.0"

# 1. Confirm this is actually a ServiceNow instance
STATS=$(curl -sk -A "$UA" --max-time 10 "$TARGET/stats.do" || true)
if ! echo "$STATS" | grep -qi "ServiceNow"; then
  echo "UNKNOWN: $TARGET did not respond as a ServiceNow instance"
  exit 3
fi

# 2. Extract build tag / version banner
BUILD_TAG=$(echo "$STATS" | grep -Eio 'Build tag: [^<]+' | head -n1)
BUILD_DATE=$(echo "$STATS" | grep -Eio 'Build date: [^<]+' | head -n1)
echo "Instance: $TARGET"
echo "$BUILD_TAG"
echo "$BUILD_DATE"

# 3. Check reachability of the vulnerable pre-auth endpoint
CODE=$(curl -sk -o /dev/null -w "%{http_code}" -A "$UA" --max-time 10 \
  "$TARGET/assessment_thanks.do")
echo "/assessment_thanks.do returned HTTP $CODE"

# 4. Decision
# The endpoint is expected to exist on affected AI Platform releases.
# Only KB3137947 hotfix builds dated 2026-06-01 or later are patched.
if echo "$BUILD_DATE" | grep -Eq '2026-0[6-9]|2026-1[0-2]|202[7-9]'; then
  echo "PATCHED: build date is post-June-2026, KB3137947 hotfix expected present"
  exit 0
fi

if [ "$CODE" = "200" ] || [ "$CODE" = "302" ]; then
  echo "VULNERABLE: pre-auth endpoint reachable AND build predates KB3137947 hotfix"
  echo "Action: apply KB3137947 hotfix immediately per noisgate CRITICAL SLA"
  exit 1
fi

echo "UNKNOWN: could not confidently determine patch state — check KB3137947 manually"
exit 3

Sources

1. ServiceNow KB3137947 advisory
2. SecurityWeek — Exploitation seen days after disclosure
3. Help Net Security — Pre-auth RCE exploited in the wild
4. BleepingComputer — Critical ServiceNow code execution flaw exploited
5. SOCRadar analysis
6. GBHackers — Unauthenticated RCE
7. CyberSecurityNews — Public PoC released
8. Rescana active exploitation alert