Critical Service Now AI Platform Flaw Exploited for Unauthenticated Code Execution
Summary: Defused Cyber reported in-the-wild exploitation of CVE-2026-6875, a sandbox escape vulnerability with a CVSS score of 9.5 in the ServiceNow AI Platform that could let an unauthenticated user run arbitrary code, though Defused later corrected its post to say the captured payload matches Searchlight Cyber's proof-of-concept. Searchlight Cyber said it reported the issue on April 1, 2026, describing it as allowing complete compromise of the ServiceNow instance and all connected proxy servers, and ServiceNow released patches throughout June while a spokesperson told The Hacker News it has not observed evidence of exploitation against instances it hosts.
Key Takeaway: A 9.5-rated pre-authentication flaw that can take the instance and every connected proxy server with it puts the blast radius well beyond a single application, and the public dispute over whether exploitation has actually occurred means self-hosted customers are deciding whether to patch on conflicting accounts.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2026-6875
- Related
- ⚡ Weekly Recap: Word Press RCE, Sonic Wall 0-Days, AI Service Attacks, Share Point 0-Day and More Cyber Risks ·Three CVSS 10.0 Service Now Flaws Could Let Unauthenticated Attackers Execute Code and SQL Cyber Risks ·University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026