ServiceNow CVE-2026-6875 is a critical, unauthenticated remote code execution flaw (CVSS 9.5) in the ServiceNow AI Platform that lets attackers escape the sandbox and run code with no login required. Exploitation began in the wild on July 18, 2026 — days after patches shipped — so any self-hosted instance should be patched immediately.

What happened. ServiceNow patched CVE-2026-6875 (CVSS 9.5, Critical, CWE-94 code injection), a remote code execution vulnerability in the ServiceNow AI Platform (formerly the Now Platform). In certain circumstances an unauthenticated attacker can escape the platform sandbox and execute code remotely. Fixes reached hosted instances first, with patches for self-hosted customers and partners released July 13, 2026. Days later, threat-intelligence firm Defused reported in-the-wild exploitation beginning July 18 — attackers hit the same pre-auth endpoint used in the public proof-of-concept, /assessment_thanks.do, but with a different sandbox-escape gadget.

Is CVE-2026-6875 being actively exploited?

Yes. Defused confirmed active exploitation starting July 18, 2026, several days after the patch. Note the nuance: NVD's entry still reads that the vendor was "not currently aware of exploitation," and the CVE is not yet in CISA KEV (EPSS sits at ~0.5%). The point-in-time signals lag the reality that exploitation is already happening.

Which ServiceNow versions are affected?

The flaw affects the ServiceNow AI Platform. Patch status:

ServiceNow notes the platform runs 100+ billion workflows a year across 85% of the Fortune 500 — a very large exposed footprint.

How do I fix CVE-2026-6875?

• Upgrade self-hosted instances to a patched release immediately.

• Confirm hosted instances show the applied fix.

• Review logs for requests to /assessment_thanks.do and other pre-auth endpoints.

• Hunt for signs of sandbox escape or unexpected code execution since July 13.

Who's affected. Any organization running a self-hosted or partner-managed ServiceNow AI Platform instance that has not applied the July 13 patch. Because exploitation needs no authentication, internet-reachable instances are the highest priority.

Our read. The gap between "patched" and "safe" is exactly where breaches live. ServiceNow shipped a fix on July 13; exploitation was live by July 18; NVD and KEV still understate it. In our 2025 KEV analysis, 20% of actively-exploited vulnerabilities were exploited on or before disclosure day, and the median disclosure-to-exploitation gap was just 26 days — CVE-2026-6875 beat even that. Waiting for KEV or a rising EPSS score to prioritize a CVSS 9.5 unauth RCE is how you get caught; continuous verification of what's actually reachable and patched is how you don't.

Reporting by BleepingComputer; exploitation detail per Defused; CVSS and CWE per NVD. Sources linked above. Related: our KEV pentest analysis.