● Covered by 3 sources · 4 reportsMedium impact
Critical ServiceNow Flaw Exploited Despite Patch Release
Key points
- CVE-2026-6875 affects ServiceNow AI Platform.
- Exploited in the wild shortly post-patch.
- Unauthenticated code execution is possible.
- Patches for hosted and self-hosted instances released.
- Self-hosted clients urged to update immediately.
Critical ServiceNow Vulnerability
A critical remote code execution vulnerability, CVE-2026-6875, has been reported in the ServiceNow AI Platform. The flaw allows attackers without authentication to execute arbitrary code remotely. The vulnerability is characterized as a sandbox escape issue.
Patch Releases and Exploitation
ServiceNow issued patches for the flaw on July 14, deploying updates to its hosted instances and providing patches for self-hosted versions. Despite these measures, threat intelligence firms observed exploitation of the vulnerability in the wild on July 18, mere days after the patches became available.
Call for Urgent Update
The active exploitation of this critical flaw underscores the importance for ServiceNow's self-hosted customers to apply the available patches without delay. The vulnerability's ability to potentially compromise entire systems and connected proxies makes timely updates crucial.
Technical Details and Implications
The vulnerability was originally reported by Searchlight Cyber. Defused, a threat intelligence firm, initially observed exploitation attempts using methods similar to Searchlight's proof of concept. This scenario serves as a reminder of the risks associated with delayed patch applications in enterprise environments.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-68759.5 CRITICAL CVE CVE-2026-149024.0 MEDIUM CVE CVE-2026-149037.7 HIGHHow outlets covered it
A critical remote code execution vulnerability in ServiceNow's AI platform (CVE-2026-6875) is reportedly being exploited in the wild, only days after it was patched. This vulnerability has functional implications for both self-hosted and ServiceNow-hosted customers, mandating immediate patching to prevent unauthorized access.
A critical security flaw (CVE-2026-6875) in the ServiceNow AI Platform is being actively exploited, allowing unauthenticated users to execute arbitrary code. Patches were released in June, but self-hosted customers are urged to apply them immediately due to ongoing attacks.
Attackers are exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, allowing them to execute code remotely. Despite ServiceNow issuing patches, researchers confirmed attacks occurring just days later, underscoring risks for enterprises using the platform.
Fortinet, Ivanti, and ServiceNow patched 15 vulnerabilities across their products, including a critical flaw in ServiceNow's AI platform. These updates are crucial for securing systems against potential exploitation, though no active attacks have been reported.