A critical vulnerability in ServiceNow’s AI Platform is now being actively exploited in the wild, according to threat intelligence firm Defused Cyber. The flaw, tracked as CVE-2026-6875 and carrying a CVSS score of 9.5, is a sandbox escape issue that lets an unauthenticated attacker execute arbitrary code on a target instance.

ServiceNow released patches throughout June, covering versions including Brazil EA and GA, Australia Patch 2, Zurich Patch 7b and 9, and Yokohama Patch 12 Hot Fix 1b and Patch 13. Security researcher Adam Kues noted that beyond fixing the bug, ServiceNow is tightening instance security by severely restricting the types of code allowed to run in sandbox environments.

Defused Cyber reports that exploitation attempts target the pre-authentication endpoint "/assessment_thanks.do" using HTTP POST requests. While the sandbox-escape gadget follows a different path than earlier proof-of-concept exploits, it ultimately achieves the same code execution result. Searchlight Cyber, which disclosed additional technical details, warned that a successful compromise can give attackers full control over the ServiceNow instance and all connected proxy servers. Customers running self-hosted versions are urged to apply the latest patches immediately if they haven't already.

Source: The Hackers News