CVE-2026-6875 Overview
CVE-2026-6875 is a remote code execution vulnerability affecting the ServiceNow AI platform. Under certain circumstances, an unauthenticated attacker can execute arbitrary code within the ServiceNow platform. ServiceNow has deployed security updates to hosted instances and provided corresponding patches to self-hosted customers and partners. The vulnerability is classified under CWE-94: Improper Control of Generation of Code. ServiceNow reports no known exploitation against instances at the time of disclosure. Customers are advised to apply the vendor-supplied updates or upgrade to a patched release promptly.
Critical Impact
Unauthenticated remote code execution in the ServiceNow AI platform enables attackers to run arbitrary code, compromising confidentiality, integrity, and availability of the ServiceNow environment.
Affected Products
- ServiceNow AI platform (hosted instances)
- ServiceNow self-hosted deployments
- ServiceNow partner-managed instances
Discovery Timeline
- 2026-07-13 - CVE-2026-6875 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-6875
Vulnerability Analysis
CVE-2026-6875 is a remote code execution flaw in the ServiceNow AI platform. The vulnerability allows an unauthenticated user, under specific conditions, to execute code within the ServiceNow platform context. Successful exploitation impacts confidentiality, integrity, and availability of the target instance and can propagate to downstream systems that trust the ServiceNow environment.
Because the ServiceNow AI platform commonly integrates with enterprise workflows, identity providers, and data stores, code execution within the platform can serve as a pivot point. Attackers can access sensitive workflow data, modify records, and abuse trust relationships with connected applications.
Root Cause
The issue is categorized as CWE-94: Improper Control of Generation of Code, indicating that untrusted input influences code generation or interpretation inside the AI platform. This class of flaw typically arises when user-controlled data is passed to an execution context, template engine, or dynamic evaluation routine without sufficient validation or sandboxing. ServiceNow has not disclosed the specific component or code path affected.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. According to the CVSS 4.0 vector, attack complexity is high, indicating that specific preconditions must be met for successful exploitation. Once triggered, the vulnerability grants code execution within the ServiceNow platform. Refer to the ServiceNow Knowledge Base Article KB3137947 for vendor-provided technical details.
No public proof-of-concept code has been released. Because verified exploit code is not available, the vulnerability mechanism is described in prose only.
Detection Methods for CVE-2026-6875
Indicators of Compromise
- Unexpected outbound network connections originating from ServiceNow instances or worker nodes
- Anomalous script execution, process spawning, or file writes in ServiceNow-hosted environments
- Unusual API calls or workflow modifications made without a corresponding authenticated user session
- New or altered scheduled jobs, business rules, or script includes with obfuscated payloads
Detection Strategies
- Review ServiceNow system logs and audit trails for unauthenticated requests that trigger script execution or workflow changes
- Correlate ServiceNow application logs with network telemetry to identify anomalous request patterns targeting AI platform endpoints
- Monitor for changes to platform configuration, integration credentials, and privileged user accounts
Monitoring Recommendations
- Forward ServiceNow audit, transaction, and security logs to a centralized SIEM or data lake for long-term retention and correlation
- Establish behavioral baselines for AI platform API traffic and alert on deviations
- Track egress traffic from self-hosted ServiceNow servers to detect command-and-control activity following successful exploitation
How to Mitigate CVE-2026-6875
Immediate Actions Required
- Apply the ServiceNow security patches referenced in KB3137947 to all self-hosted instances
- Verify that hosted ServiceNow instances have received the vendor-deployed update
- Audit ServiceNow instances for unauthorized changes to scripts, business rules, and integration configurations
- Rotate credentials, API keys, and OAuth secrets used by ServiceNow integrations if compromise is suspected
Patch Information
ServiceNow has deployed a security update to all hosted instances. Self-hosted customers and partners have been provided with security patches through the listed family releases. Consult the ServiceNow Knowledge Base Article KB3137947 for the specific patch versions and family releases that address CVE-2026-6875.
Workarounds
- Restrict network exposure of ServiceNow AI platform endpoints to trusted networks where feasible until patching is complete
- Place a web application firewall in front of self-hosted ServiceNow instances and enable rules that block anomalous requests to AI platform endpoints
- Disable or restrict AI platform features that are not in active use to reduce attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
