ServiceNow RCE Vulnerability Exploited in the Wild
Critical Pre-Authentication Breach
Hackers have begun breaching corporate systems via a critical ServiceNow RCE vulnerability. This severe flaw allows them to infiltrate servers without an account and execute arbitrary code. Cybersecurity specialists at Defused recorded the initial attempts to exploit CVE-2026-6875 (9.5 Critical) on July 17. The threat actors dispatched meticulously crafted requests to the publicly accessible /assessment_thanks.do page. Consequently, they successfully circumvented the ServiceNow sandbox to execute malicious commands.
Discovery and Coordinated Patching
Searchlight Cyber originally discovered this critical flaw. They responsibly disclosed the issue to the developer on April 1, 2026. You can review their detailed technical analysis on smashing the ServiceNow sandbox. ServiceNow commenced fortifying its cloud infrastructure within a mere 24 hours. Subsequently, they engineered comprehensive patches. Updates for self-hosted corporate servers were officially released on July 13.
Exploiting the GlideRecord Mechanism
The core issue stems from the GlideRecord query mechanism. ServiceNow utilizes this framework to interact with internal database tables. Certain web pages inadvertently transmitted data from unauthenticated users into these queries. The platform permitted script execution within the query parameters. However, it rigidly confined these operations to a restricted sandbox environment.
Escaping the Sandbox Confinement
Fortunately for attackers, researchers devised an ingenious method to escape this sandbox. They manipulated several intrinsic JavaScript functions. Following this, they compelled ServiceNow to load a core system library containing these altered objects. Consequently, the defense mechanism inadvertently generated a function harboring the attacker’s code. This executed entirely free from its original constraints.
Cascading Network Compromise
Following a successful breach, an adversary could seamlessly extract sensitive data from internal tables. Furthermore, they could forge administrator accounts and commandeer connected MID servers. These intermediary servers frequently reside deep within corporate networks. They bridge ServiceNow with local organizational systems. Thus, this single vulnerability could unlock unfettered access to expansive internal corporate resources.
Defused reports that contemporary real-world attacks exploit the identical public endpoint detailed by Searchlight Cyber. Yet, these threat actors bypass the sandbox utilizing an entirely different methodology. The intricate details of this novel variant remain undisclosed at this time.
Official Response and Guarded Scripts
ServiceNow has yet to officially acknowledge the active exploitation of this vulnerability in its security advisories. The corporation affirmed it has detected no evidence of attacks against its managed cloud environments. Nevertheless, the developer urgently implored clients to deploy the patches immediately. This is particularly crucial for organizations operating the platform on self-hosted enterprise servers.
In the aftermath of this discovery, ServiceNow profoundly reinforced its restrictions concerning pre-authentication scripts. The newly implemented Guarded Script mechanism strictly permits only a single, elementary expression. It explicitly prohibits variable declarations, loop constructs, function definitions, and the execution of multiple commands within a singular script.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
