Ravie LakshmananJul 21, 2026Vulnerability / Artificial Intelligence
Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber.
In a post shared on X, the threat intelligence firm said it’s observing in-the-wild exploitation of CVE-2026-6875 (CVSS score: 9.5), a sandbox escape vulnerability that could allow an unauthenticated user to run arbitrary code.
Patches for the flaw were released by ServiceNow throughout June in the following versions –
- Brazil EA and Brazil GA
- Australia Patch 2
- Zurich Patch 7b and Zurich Patch 9
- Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13
Searchlight Cyber, which disclosed additional technical specifics, said it reported the issue on April 1, 2026, adding it allows a complete compromise of the ServiceNow instance as well as all connected proxy servers.
Besides rolling out a fix, ServiceNow is “enhancing instance security by severely restricting the type of code that can run in sandbox contexts,” security researcher Adam Kues noted.
Defused initially noted that the exploitation efforts target the same pre-authentication endpoint (“https://thehackernews.com/assessment_thanks.do”) using HTTP POST requests, although the sandbox-escape gadget leads to the same code execution primitive by a different route documented in the proof-of-concept (PoC) exploit.
However, in a subsequent post, Defused issued a correction, stating the captured payload in fact matches that of Searchlight Cyber’s PoC.
In light of active exploitation, customers of self-hosted versions are advised to apply the fixes, if not already, to counter the threat.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
