CVE-2026-6875 is a pre-authentication remote code execution vulnerability in the ServiceNow AI Platform, carrying a CVSS v4.0 score of 9.5. The vulnerability allows unauthenticated actors to execute arbitrary code without user interaction. The mechanism resides in the GlideRecord query engine, which supports a javascript: filter operator intended to evaluate user-supplied input. The endpoint /assessment_thanks.do facilitates this by passing unauthenticated input directly into the query engine via the sysparm_assessable_type parameter, bypassing standard authentication checks.
The exploitation relies on a two-layer sandbox escape. While the inner sandbox environment restricts common execution primitives such as eval, new Function(), and function declarations, it permits the use of Object.defineProperty. Attackers leverage this by overriding Object.clone with the Function constructor and assigning a class prototype to their malicious payload. This manipulation allows the subsequent use of gs.include() to load library code outside the restrictive inner sandbox. By executing in the outer context, the attacker coerces the platform’s internal class-extension logic into invoking the Function constructor with the attacker-supplied code, achieving full system execution.
The impact of this vulnerability includes full read and write access to any ServiceNow table and the ability to create administrative accounts. Furthermore, the compromise extends to connected MID Server proxies. Because these servers typically reside within customer internal networks to facilitate communication between the cloud platform and on-premises infrastructure, a successful exploit provides a direct beachhead for lateral movement into the broader enterprise network.
The platform’s footprint includes 85% of the Fortune 500 and processes over 100 billion workflows annually across 8,800 global customers. While ServiceNow deployed cloud-based mitigations within 24 hours of the April 1, 2026 report, self-hosted and partner-hosted instances remained vulnerable until the release of patches on July 13, 2026. The five-day window between the patch release and the first observed in-the-wild exploitation by Defused on July 18, 2026, indicates the speed at which attackers weaponize disclosed vulnerabilities.
The discovery by Defused that attackers are utilizing a different gadget chain than the one originally identified by Searchlight Cyber confirms that multiple viable paths exist to reach the same code-execution primitive. This reality renders simple patching insufficient, as the underlying architectural flaw in the sandbox implementation remains exploitable through alternative gadget chains. The existence of these multiple chains necessitates a fundamental change to the execution environment rather than iterative patch management.
This vulnerability introduces a fourth frame to the Forkast threat model trilogy, categorizing CVE-2026-6875 as AI platform infrastructure as an attack surface. It joins the existing frames of ENCFORGE, which covers AI-as-target and destruction-as-a-service; Sandbox Escape, which addresses AI-as-attacker and autonomous breach; and JadePuffer, which focuses on AI-as-operator and autonomous kill chains. This new frame addresses the risks inherent in the foundational infrastructure supporting AI-driven enterprise workflows.
The architectural response to this vulnerability is the introduction of Guarded Script (KB2944435). Unlike standard patches, Guarded Script alters the inner sandbox by restricting it to single, simple expressions. This change blocks variable declarations, control flow, function declarations, assignment operators, and multi-statement scripts. By enforcing these constraints, the update eliminates the necessary preconditions for the gadget chains required to escape the sandbox, neutralizing the attack surface regardless of the specific gadget chain employed.
The timeline of this incident, from the initial report on April 1 to the exploitation observed on July 18, shows the necessity of rapid deployment for self-hosted instances. ServiceNow has stated that it has not observed evidence of this activity on instances it hosts, placing the burden of risk management on organizations maintaining their own infrastructure. As of July 20, 2026, the advisory KB3137947 had not been updated to acknowledge the exploitation activity, leaving many administrators without full visibility into the urgency of the threat.
The reliance on MID Servers as a bridge between the cloud platform and internal networks remains a primary security concern. Organizations must treat their ServiceNow instances not merely as SaaS applications, but as critical infrastructure components that, if compromised, provide an immediate pathway into the internal network. The transition from a platform-level vulnerability to an internal network breach is a direct consequence of this architectural integration.
Security teams must shift from reactive patching to the implementation of architectural constraints like Guarded Script. The ability of attackers to pivot between different gadget chains shows that the platform’s previous sandbox design was insufficient against determined actors. Future security posture for enterprise AI platforms depends on the ability to enforce strict, immutable boundaries around script execution environments.