Critical ServiceNow Vulnerability Allows Remote Attackers to Execute Malicious Code

ServiceNow has disclosed and fixed a critical security vulnerability in its AI Platform that could allow unauthenticated attackers to execute code within affected ServiceNow environments.

The flaw, tracked as CVE-2026-6875, is described as a sandbox escape vulnerability and affects both hosted and self-hosted ServiceNow deployments.

ServiceNow said the vulnerability could allow an attacker to circumvent intended platform restrictions and execute code in certain circumstances.

Because exploitation does not require authentication, the issue could pose a serious risk to exposed ServiceNow instances that have not received the required security updates.

Enterprises widely use ServiceNow for IT service management, workflow automation, customer operations, security operations, and internal business processes.

A successful remote code execution attack against such a platform could enable attackers to disrupt workflows, access sensitive data, modify records, or use the compromised environment as a launch point for further activity.

ServiceNow Vulnerability

The vulnerability exists in the ServiceNow AI Platform. However, the company has not released detailed technical information about the underlying cause.

The company published the advisory as KB3137947 on July 13, 2026, keeping details limited to give customers time to patch before attackers can develop reliable exploits.

ServiceNow has already deployed security updates to its hosted instances. The company also made relevant updates available to self-hosted customers and partners.

Organizations that manage their own ServiceNow environments should review their current family release and install the appropriate patch or upgrade to a fixed version as soon as possible.

The issue is fixed in Brazil Early Access and Brazil General Availability releases. For Australia, the vulnerability is addressed in Australia Patch 2.

Zurich customers should install Zurich Patch 7b or Zurich Patch 9. Yokohama users are protected by Yokohama Patch 12 Hot Fix 1b or Yokohama Patch 13. ServiceNow said it is not currently aware of active exploitation of CVE-2026-6875 in the wild.

However, public disclosure of a critical unauthenticated remote code execution flaw can quickly attract attention from security researchers and malicious actors. Organizations should therefore treat the issue as urgent even if they have not observed suspicious activity.

Administrators should confirm whether their ServiceNow instance is hosted by ServiceNow or deployed in a self-hosted environment.

Hosted customers should verify that the platform update has been applied. At the same time, self-hosted administrators should review ServiceNow’s security maintenance guidance and patch status.

Security teams should also monitor administrative activity, unusual integrations, unexpected workflow changes, and suspicious API behavior following the update.

The CVE record for CVE-2026-6875 is available through CVE.org, while additional patch and maintenance information is provided in ServiceNow advisories KB2930717 and KB2930740. Prompt remediation remains the most effective defense against potential exploitation.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.