Executive Summary
In April 2026, a critical vulnerability (CVE-2026-6875) was identified in the ServiceNow AI Platform, allowing unauthenticated attackers to escape the sandbox and execute code remotely. ServiceNow promptly addressed the flaw in hosted instances and released security updates for self-hosted customers on July 13, 2026. Despite these measures, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild as of July 20, 2026.
This incident underscores the persistent threat posed by unpatched vulnerabilities in widely used enterprise platforms. Organizations relying on ServiceNow's AI Platform must ensure they have applied the latest security updates to mitigate potential risks associated with this flaw.
Why This Matters Now
The active exploitation of CVE-2026-6875 highlights the urgency for organizations to apply the latest patches to prevent unauthorized code execution within their ServiceNow environments.
Attack Path Analysis
Attackers exploited CVE-2026-6875 to gain unauthorized access to the ServiceNow AI Platform. They then escalated privileges within the platform, moved laterally to other systems, established command and control channels, exfiltrated sensitive data, and caused significant operational disruption.
Kill Chain Progression
Initial Compromise
Description
Attackers exploited CVE-2026-6875, a critical pre-authentication remote code execution vulnerability in the ServiceNow AI Platform, to gain unauthorized access.
Related CVEs
CVE-2026-6875
CVSS 9.5A remote code execution vulnerability in the ServiceNow AI Platform allows unauthenticated attackers to execute arbitrary code within the platform.
Affected Products:
ServiceNow ServiceNow AI Platform – Australia Patch 2 and earlier, Yokohama Patch 12 Hot Fix 1b and earlier, Yokohama Patch 13 and earlier, Zurich Patch 7b and earlier, Zurich Patch 9 and earlier, Brazil EA and earlier, Brazil GA and earlier
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Client Execution
Exploitation of Remote Services
Valid Accounts
Impair Defenses
Obfuscated Files or Information
Exfiltration Over C2 Channel
Inhibit System Recovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Asset Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Critical ServiceNow RCE vulnerability enables unauthenticated remote code execution, compromising enterprise AI workflows and requiring immediate patching across IT infrastructure platforms.
Financial Services
ServiceNow platform exploitation threatens financial institutions' AI-driven operations, potentially exposing sensitive data and violating compliance requirements through sandbox escape attacks.
Health Care / Life Sciences
Healthcare organizations using ServiceNow AI Platform face critical risk of patient data exposure and HIPAA violations through pre-authentication remote code execution.
Government Administration
Government agencies leveraging ServiceNow for enterprise workflows vulnerable to sophisticated threat actors exploiting CVE-2026-6875 for unauthorized system access and data theft.
Sources
- Critical ServiceNow code execution flaw now exploited in attackshttps://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/Verified
- CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platformhttps://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947Verified
- Smashing the ServiceNow Sandbox – Pre Authentication RCEhttps://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial exploitation may still occur, Aviatrix CNSF would likely limit the attacker's ability to leverage the compromised access to further infiltrate the network.
Control: Zero Trust Segmentation
Mitigation: Aviatrix Zero Trust Segmentation would likely constrain the attacker's ability to escalate privileges by enforcing strict identity-based access controls.
Control: East-West Traffic Security
Mitigation: Aviatrix East-West Traffic Security would likely limit the attacker's ability to move laterally by enforcing strict segmentation between workloads.
Control: Multicloud Visibility & Control
Mitigation: Aviatrix Multicloud Visibility & Control would likely detect and constrain unauthorized command and control communications.
Control: Egress Security & Policy Enforcement
Mitigation: Aviatrix Egress Security & Policy Enforcement would likely limit the attacker's ability to exfiltrate data by controlling and monitoring outbound traffic.
With Aviatrix CNSF controls in place, the overall impact of the attack would likely be reduced, limiting operational disruption and data loss.
Impact at a Glance
Affected Business Functions
- Workflow Automation
- Incident Management
- Service Catalog
- Customer Service Management
Estimated downtime: 7 days
Estimated loss: $500,000
Potential exposure of sensitive customer data and internal operational information.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Deploy Inline IPS (Suricata) to detect and prevent exploitation attempts of known vulnerabilities.
- • Utilize Multicloud Visibility & Control to monitor and manage traffic across cloud environments.
- • Enforce Egress Security & Policy Enforcement to control outbound traffic and prevent data exfiltration.
- • Regularly update and patch systems to mitigate known vulnerabilities like CVE-2026-6875.
