CVE-2026-6875 in Plain Terms: A Pre-Auth Sandbox Escape With Full RCE
CVE-2026-6875 is a critical pre-authentication sandbox escape vulnerability in the ServiceNow AI Platform that allows unauthenticated attackers to inject code, break out of the script sandbox, and execute arbitrary commands remotely on affected instances, leading to complete compromise risks for both the platform and connected infrastructure.
This is not another theoretical “nice-to-patch” bug; it is a live ServiceNow RCE vulnerability with a CVSS score of 9.5 that removes both authentication and sandbox barriers in one move. In practice, that means an attacker can talk directly to your AI Platform, escape its sandbox, and run code as if they were inside your environment. When defenders hear “pre-auth sandbox escape,” the correct mental model is “exposed application server with shell access” rather than “limited script abuse.” Teams that treat this as a routine ticket risk giving attackers a straight path into ticketing data, workflow logic, and integrations wired into critical systems.
How the CVE-2026-6875 Exploit Works—and Why Proxy Servers Are at Risk
Attackers are already abusing the same pre-authentication endpoint, “/assessment_thanks.do,” via HTTP POST requests to deliver payloads that trigger the sandbox escape gadget and gain the same code execution primitive described in public proof-of-concept exploits. This is the classic nightmare pattern: a remotely reachable, unauthenticated endpoint coupled with a script sandbox that can be broken to achieve full remote code execution.
Searchlight Cyber has stated that the flaw allows a complete compromise of the ServiceNow instance as well as all connected proxy servers, turning integration points into force multipliers for the attacker. Once inside, they can pivot across systems your AI Platform is wired into, using those proxies as high-trust footholds. That makes this CVE-2026-6875 exploit more than a single-app issue; it is a platform and network exposure, especially in environments that have treated their AI Platform as a safe, sandboxed island rather than a high-value target.
Patch Status: Who Is Affected and What ServiceNow Has Changed
Patches for this ServiceNow RCE vulnerability were released throughout June across multiple AI Platform release tracks: Brazil EA and Brazil GA, Australia Patch 2, Zurich Patch 7b and Zurich Patch 9, and Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13. If your self-hosted or hosted instance is not at one of these levels or later, you should treat it as exposed.
According to ServiceNow, “We have provided updates and patches designed to address this issue, and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so.” Beyond the immediate fixes, the company is tightening the sandbox itself by “severely restricting the type of code that can run in sandbox contexts,” acknowledging that script flexibility has a security cost. This is a welcome move, but it is also a warning shot: if your workflows depend on permissive sandbox behavior, expect to revisit and harden them as the platform shifts toward safer defaults.
Is It Really Being Exploited? Why Defenders Can’t Afford to Hesitate
Threat intelligence firm Defused reports in-the-wild exploitation of CVE-2026-6875 against the ServiceNow AI Platform, describing active attempts to use the pre-auth endpoint to trigger remote code execution. While ServiceNow has said that, based on its investigation, “there has been no exploitation observed to date,” defenders would be reckless to side with the most optimistic interpretation in a case like this.
This tension between vendor telemetry and independent threat reporting is not new, but the presence of public PoC code and concrete attack patterns tips the balance toward action. When a CVSS 9.5 pre-auth sandbox escape is reported as exploited, the safe assumption is that even if your instance has not been hit yet, it is being scanned, probed, or will be soon. Security teams should treat the Defused reporting as an early warning and assume hostile traffic is already in play at the edge of their ServiceNow deployments.
Immediate Steps for Enterprise Teams: From Patching to Monitoring
In light of active exploitation reporting, self-hosted customers are explicitly advised to apply the available fixes if they have not already done so, and the same encouragement extends to ServiceNow-hosted customers. That is the non-negotiable first step: bring every AI Platform instance up to a patched Brazil, Australia, Zurich, or Yokohama level and validate that deployment succeeded across production, staging, and DR environments.
Next, focus on exposure and detection. Inventory every internet-facing ServiceNow AI endpoint, including `/assessment_thanks.do`, and inspect logs for unusual POST patterns or failed sandbox executions around the disclosure and patch windows. Because this flaw enables complete compromise of instances and connected proxy servers, assume that any unpatched node could have been a beachhead and review downstream systems for signs of misuse. Finally, security leads should resist the urge to treat this as a one-off scare: the combination of pre-auth access, sandbox escapes, and rich AI-integrated workflows is a pattern that will repeat. The right response is not only to patch, but to reset expectations about how exposed “AI platforms” now are and harden them as first-class critical infrastructure.
