A Critical, Unauthenticated Vulnerability in ServiceNow Is Under Active Attack — Here's What Enterprise IT Teams Need to Know

I covered a WordPress vulnerability a couple weeks ago that put half a billion consumer sites at risk. This one is a different kind of scale entirely. ServiceNow's AI Platform — the workflow automation backbone running inside 85% of Fortune 500 companies and processing more than 100 billion enterprise workflows a year — has a critical, unauthenticated remote code execution vulnerability that's now being actively exploited in the wild. No login required, no phishing needed, no prior foothold in your network necessary. If your organization runs a self-hosted ServiceNow instance and hasn't applied the July 13 patch, this is the story that should interrupt your day. The direct answer: CVE-2026-6875 is a critical, CVSS 9.5-rated pre-authentication remote code execution vulnerability in ServiceNow's AI Platform, disclosed publicly on July 13, 2026, and confirmed under active exploitation starting July 17. It allows an unauthenticated attacker with network access to fully compromise a vulnerable ServiceNow instance and any connected proxy servers. ServiceNow patched its own hosted instances in April, before public disclosure, but self-hosted customer instances remained exposed until patches were released July 13 — and attackers have already found a second way to exploit the underlying flaw beyond the original published proof of concept. Quick Facts Detail Info CVE CVE-2026-6875 Severity Critical — CVSS 9.5 Vulnerability type Unauthenticated remote code execution via sandbox escape Platform affected ServiceNow AI Platform (formerly Now Platform) Discovered by Searchlight Cyber Public disclosure July 13, 2026 ServiceNow-hosted instances Patched in April 2026, before public disclosure Self-hosted instances Patches released July 13, 2026 Active exploitation confirmed Yes — first observed July 17, 2026, by threat intel firm Defused Entry point /assessment_thanks.do endpoint via ServiceNow's GlideRecord query API Authentication required None Scale of platform 100+ billion workflows annually; used by 85% of Fortune 500 companies How This Unfolded April 2026: ServiceNow quietly patched its own hosted instances, ahead of any public disclosure — meaning customers on ServiceNow's hosted infrastructure were already protected months before this became public knowledge. July 13: Searchlight Cyber's research became public, alongside ServiceNow's own security advisory (KB3137947) and the official CVE-2026-6875 record. ServiceNow simultaneously released patches for self-hosted instances, which had remained exposed up to this point. Searchlight's researchers noted this wasn't their first find in ServiceNow's codebase — the team returned to a different part of the platform after finding an earlier critical pre-auth bug roughly two years prior, applying a deeper understanding of the architecture to find this one. July 14: Searchlight Cyber published a detailed technical write-up documenting a working sandbox-escape exploit chain. July 17-18: Threat intelligence firm Defused confirmed the first real-world exploitation attempts, observed hitting the same vulnerable endpoint documented in Searchlight's research. Active, in-the-wild abuse was confirmed over the following weekend. Ongoing: ServiceNow's public position has been that it isn't aware of exploitation against instances it directly hosts — consistent with those instances having been patched back in April — while continuing to urge self-hosted and any remaining unpatched customers to apply available patches immediately. How the Vulnerability Actually Works At a conceptual level, the flaw sits in how ServiceNow's platform handles user-supplied data reaching its GlideRecord query API — a core piece of functionality that accepts input in hundreds of places across ServiceNow's codebase. Certain values that should have been blocked by the platform's input filters were instead evaluated as executable script inside a restricted sandbox environment, and researchers found a way to escape that sandbox entirely, reaching full code execution on the underlying server without ever needing valid credentials. What makes this particularly serious from a defender's standpoint is a detail that emerged after the initial disclosure: attackers exploiting this in the wild aren't using the exact same technique Searchlight Cyber published. They're hitting the same vulnerable endpoint, but reaching code execution through a different sandbox-escape method than the one described in the original proof of concept. That's a meaningful signal about how quickly real attackers can independently discover alternate paths to the same underlying flaw once a vulnerability class becomes public — meaning defenses built narrowly around blocking the published proof-of-concept specifically, rather than the underlying vulnerable pattern, may not have been sufficient on their own. Is Your Organization Affected? Deployment Type Status ServiceNow-hosted instances Patched in April 2026 — should already be protected if you use S