CVE-2026-6875: Critical ServiceNow Sandbox Escape Allows Unauthenticated Remote Code Execution

TL;DR

ServiceNow has patched a critical ServiceNow sandbox escape flaw, tracked as CVE-2026-6875 (CVSS 9.5), in its AI Platform. The bug could let an unauthenticated attacker, in certain circumstances, execute code inside the ServiceNow platform. Hosted instances have already received the fix, and self-hosted customers should apply the listed patches now.

Why It Matters

ServiceNow sits at the heart of IT service management for thousands of large enterprises. Consequently, a remote code execution flaw of this severity puts workflow data, credentials, and connected systems at risk. Moreover, the vulnerability requires no authentication, which lowers the bar for attack dramatically. A successful ServiceNow sandbox escape could hand an outsider a foothold inside a core business platform.

How the Attack Works

The flaw resides in the sandbox environment of the ServiceNow AI Platform. This sandbox is designed to contain AI-related code safely. Under specific conditions, however, the isolation boundary fails to hold. As a result, an unauthenticated remote attacker could break out of the containment and run code within the ServiceNow platform itself. ServiceNow has not published deeper technical details, and this report intentionally omits exploitation specifics.

Affected Versions

The vulnerability affects the Brazil, Australia, Zurich, and Yokohama family releases. Fixed versions include Brazil EA, Brazil GA, Australia Patch 2, Zurich Patch 7b, Zurich Patch 9, Yokohama Patch 12 Hot Fix 1b, and Yokohama Patch 13.

Exploitation Status

According to the vendor, no exploitation against ServiceNow instances has been confirmed at this time. Additionally, no public proof-of-concept code has been observed.

Patch and Mitigation

ServiceNow has already deployed a security update to hosted instances. Self-hosted customers and partners should upgrade to a patched release without delay. For full details, review the official ServiceNow security advisory.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.