ServiceNow has addressed a critical vulnerability in its AI platform following the public release of a proof-of-concept (PoC) exploit demonstrating pre-authentication remote code execution (RCE). This flaw, identified as CVE-2026-6875, involves a sandbox escape that could allow unauthenticated attackers to execute arbitrary code within vulnerable ServiceNow instances.
Researchers from Assetnote at Searchlight Cyber detailed the vulnerability in their report titled “Smashing the ServiceNow Sandbox: Pre-Authentication RCE.” They discovered that exploiting this flaw could lead to full compromise of a ServiceNow instance, granting attackers access to data stored in tables, the ability to create administrator accounts, and the potential to execute commands on connected MID Server proxy systems.
ServiceNow responded by publishing advisory KB3137947 on July 13, 2026, confirming the impact of CVE-2026-6875 on the ServiceNow AI platform. The company implemented protections for hosted instances and released updates for self-hosted customers and partners. As of the advisory’s release, ServiceNow reported no known active exploitation of this vulnerability in the wild.
Details of the PoC Exploit
The PoC exploit targets the platform’s GlideRecord query API, a component widely used by ServiceNow applications to retrieve and process table data. Researchers found that certain pre-authentication application paths passed user-controlled input into GlideRecord query functions. By crafting specific JavaScript query values, attackers could cause the supplied JavaScript to be evaluated before the query execution.
Although ServiceNow employs a restricted script sandbox to block dangerous capabilities—such as direct use of eval, dynamic function creation, arbitrary function declarations, and access to sensitive Java classes—Assetnote identified a method to bypass these restrictions. This was achieved through the platform’s script-include mechanism, where the gs.include() function loads script libraries in a less restricted execution context.
By manipulating global JavaScript objects and properties used by included scripts, attackers could execute code outside the stricter sandbox. This technique exploited changes to JavaScript object properties and function constructor behavior, transitioning from restricted script execution to a more privileged ServiceNow scripting context.
Once outside the sandbox, attackers could interact with ServiceNow’s internal APIs with significantly fewer restrictions. This access could enable database interactions, administrative actions, and engagement with configured MID Servers. MID Servers, commonly deployed within enterprise networks, connect ServiceNow cloud instances with internal systems, amplifying the potential impact of a compromise.
Assetnote reported the issue to ServiceNow on April 1, 2026. ServiceNow responded promptly, introducing an immediate cloud-side mitigation within 24 hours by preventing changes to critical JavaScript functions. The vendor subsequently issued comprehensive patches to address the vulnerability across all affected instances.
This incident underscores the critical importance of timely patch management and vigilant monitoring of enterprise platforms. Organizations utilizing ServiceNow should ensure that all instances are updated with the latest security patches to mitigate potential exploitation risks. Additionally, this case highlights the need for continuous security assessments and the implementation of robust access controls to safeguard against emerging threats.
