Skip to content
OpenAdvisories
Critical · 9.5 Scanner template Public exploit CVE-2026-6875 EUVD-2026-43520GHSA-8jw2-7qp4-v2jj

Sandbox Escape in ServiceNow AI Platform

Published Jul 13, 2026 · Updated Aug 27, 2026 · Assigned by SN

Vendor: ServiceNow Product: ServiceNow AI Platform

Description

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.

ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.

Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Affected products

VendorProductAffectedFixed
ServiceNow ServiceNow AI Platform < Australia Patch 2, < Yokohama Patch 12 Hot Fix 1b, < Yokohama Patch 13, < Zurich Patch 7b, < Zurich Patch 9, < Brazil EA, < Brazil GA Australia Patch 2

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • tc4dy/CVE-2026-6875-PoC-Exploit ★ 4 · Jul 21, 2026

    CVE-2026-6875 ServiceNow Pre-Auth RCE Framework | JS Injection → Sandbox Escape → RCE → Root. Features: --detect, --exec, reverse/interactive shell, batch threading, WAF bypass, persistence, lateral …

  • HORKimhab/CVE-2026-6875 ★ 1 · Jul 21, 2026

    CVE-2026-6875

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 1

References