CVE-2026-6875

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform (affected versions not specified)

Description A critical pre-authentication sandbox-escape flaw exists in the ServiceNow AI Platform. This issue allows an unauthenticated attacker to bypass the platform's sandbox environment and execute arbitrary code remotely. The attack chain involves the use of GlideRecord, JavaScript evaluation, and Script Includes. Specifically, attackers have been observed targeting the /assessment thanks.do endpoint to achieve code execution. The platform is widely used, powering over 100,000 enterprise AI applications and serving 85% of Fortune 500 companies. Although the vendor initially stated no knowledge of active exploitation, threat intelligence researchers have confirmed in-the-wild attacks occurring shortly after the release of patches for self-hosted instances.

Recommendations Upgrade to a patched release immediately. Monitor requests for anomalous activity. Review the Guarded Script protections. For instances created before September 2024, disable the sandbox enabled setting for any Client Callable Script Includes (Glide AJAX Enabled) unless specifically required.