"ServiceNow is enhancing instance security by severely restricting the type of code that can run in sandbox contexts," security researcher Adam Kues noted.
CVE-2026-6875: a sandbox escape that enables unauthenticated code execution
Security researchers have identified CVE-2026-6875, a critical sandbox escape vulnerability in the ServiceNow AI Platform assigned a CVSS score of 9.5. The flaw can allow an unauthenticated user to run arbitrary code against a vulnerable instance. Searchlight Cyber, which disclosed additional technical specifics, reported the issue to ServiceNow on April 1, 2026, and said the vulnerability "allows a complete compromise of the ServiceNow instance as well as all connected proxy servers."
Observed exploitation pattern and PoC details
Threat intelligence firm Defused Cyber reported active, in‑the‑wild exploitation. According to Defused, the exploitation efforts target the same pre‑authentication endpoint — "/assessment_thanks.do" — and use HTTP POST requests. Defused noted the sandbox‑escape gadget reaches the same code‑execution primitive by a different route documented in a proof‑of‑concept exploit. The combination of a publicly documented PoC and observed POST targeting of a pre‑auth endpoint is the immediate technical signal driving urgency around mitigation.
ServiceNow response and patches released in June
ServiceNow issued fixes for the vulnerability during June. The patched releases listed by ServiceNow cover multiple platform lines and include:
- Brazil EA and Brazil GA
- Australia Patch 2
- Zurich Patch 7b and Zurich Patch 9
- Yokohama Patch 12 Hot Fix 1b and Yokohama Patch 13
Beyond providing patches, ServiceNow has tightened sandbox controls. As Adam Kues described, the vendor is "severely restricting the type of code that can run in sandbox contexts" as an additional mitigation to reduce the attack surface exploited by the sandbox‑escape gadget.
What this means for self-hosted ServiceNow customers, security teams, and threat actors
- Self‑hosted ServiceNow customers: Defused Cyber explicitly advises customers of self‑hosted versions to apply the June fixes if they have not already done so. The patches released across Brazil, Australia, Zurich, and Yokohama builds are the corrective measures provided by ServiceNow.
- Security teams and technologists: Teams responsible for monitoring and incident response should be aware that observed exploitation targets a pre‑authentication endpoint ("/assessment_thanks.do") via HTTP POST and that a proof‑of‑concept exists that achieves the same code‑execution primitive by an alternate route. Those facts narrow the indicators to watch for and the vectors to prioritize in detection and containment activities.
- Threat actors: Defused's observation of in‑the‑wild activity confirms adversaries are actively exploiting the flaw. Searchlight Cyber's disclosure that the vulnerability enables complete compromise of instances and connected proxies underscores the operational value attackers may derive from successful exploitation.
The record here is stark and specific: a high‑severity sandbox escape (CVE-2026-6875, CVSS 9.5) has a documented PoC, patches were released in June across multiple ServiceNow platform versions, and defenders are already seeing exploitation against a pre‑authentication POST endpoint. ServiceNow's decision to both patch and further constrain sandboxed code reflects the twofold response required when a notably broad primitive—unauthenticated arbitrary code execution—lands in the wild.
For organizations running self‑hosted instances, the immediate, concrete step is the one the reporting repeats: apply the available June fixes without delay. With proof‑of‑concept code and observed targeting of "/assessment_thanks.do," leaving vulnerable instances unpatched invites the very compromise Searchlight warned about: total instance takeover and exposure of connected proxy servers.
