Vulnerability-Lookup

CVE-2026-6875 (GCVE-0-2026-6875)

Vulnerability from cvelistv5 – Published: 2026-07-13 18:17 – Updated: 2026-07-14 03:55

KEVIntel

Title

Sandbox Escape in ServiceNow AI Platform

Summary

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Severity

9.5 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

References

1 reference

URL	Tags
https://support.servicenow.com/kb?id=kb_article_v…

Impacted products

1 product

Vendor	Product	Version
ServiceNow	ServiceNow AI Platform	Affected: 0 , < Australia Patch 2 (custom) Affected: 0 , < Yokohama Patch 12 Hot Fix 1b (custom) Affected: 0 , < Yokohama Patch 13 (custom) Affected: 0 , < Zurich Patch 7b (custom) Affected: 0 , < Zurich Patch 9 (custom) Affected: 0 , < Brazil EA (custom) Affected: 0 , < Brazil GA (custom)

Credits

Adam Kues - Assetnote

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 85d8f5a6-1f65-43ae-99b9-83a6f1dc4d62

Vulnerability ID: CVE-2026-6875

Status: Confirmed

Status Updated: 2026-07-18 10:55 UTC

Exploited: Yes

Timestamps

First Seen: 2026-07-18

Asserted: 2026-07-18

Scope

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	Sandbox Escape in ServiceNow AI Platform
Vendor	ServiceNow
Product	ServiceNow AI Platform
Added Date	2026-07-18T10:55:00.000Z
Cvss Score	9.5
Epss Score	0.00509
Cvss Severity	CRITICAL
Epss Percentile	0.40039
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-07-20 09:00 UTC | Updated: 2026-07-20 09:00 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T03:55:45.828Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ServiceNow AI Platform",
          "vendor": "ServiceNow",
          "versions": [
            {
              "lessThan": "Australia Patch 2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Yokohama Patch 12 Hot Fix 1b",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Yokohama Patch 13",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Zurich Patch 7b",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Zurich Patch 9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Brazil EA",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Brazil GA",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adam Kues - Assetnote"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/div\u003e"
            }
          ],
          "value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\n\n\n\n\nFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\n\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.5,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-13T18:20:50.748Z",
        "orgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
        "shortName": "SN"
      },
      "references": [
        {
          "url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Sandbox Escape in ServiceNow AI Platform",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "303448ea-6ef3-4077-ad29-5c9bf253c375",
    "assignerShortName": "SN",
    "cveId": "CVE-2026-6875",
    "datePublished": "2026-07-13T18:17:27.508Z",
    "dateReserved": "2026-04-22T18:21:24.368Z",
    "dateUpdated": "2026-07-14T03:55:45.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-6875",
      "date": "2026-08-04",
      "epss": "0.24489",
      "percentile": "0.97656"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-6875\",\"sourceIdentifier\":\"psirt@servicenow.com\",\"published\":\"2026-07-13T19:17:36.440\",\"lastModified\":\"2026-07-14T05:16:19.730\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\\n\\n\\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\\n\\n\\n\\n\\nFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\\n\\n\\n\\n\\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.\"}],\"affected\":[{\"source\":\"psirt@servicenow.com\",\"affectedData\":[{\"vendor\":\"ServiceNow\",\"product\":\"ServiceNow AI Platform\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"Australia Patch 2\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"Yokohama Patch 12 Hot Fix 1b\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"Yokohama Patch 13\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"Zurich Patch 7b\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"Zurich Patch 9\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"Brazil EA\",\"versionType\":\"custom\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"Brazil GA\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@servicenow.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.5,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"HIGH\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-13T00:00:00+00:00\",\"id\":\"CVE-2026-6875\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-94\"}]}],\"references\":[{\"url\":\"https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947\",\"source\":\"psirt@servicenow.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-6875\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-13T18:56:48.281207Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-13T18:57:10.817Z\"}}], \"cna\": {\"title\": \"Sandbox Escape in ServiceNow AI Platform\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Adam Kues - Assetnote\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.5, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"ServiceNow\", \"product\": \"ServiceNow AI Platform\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Australia Patch 2\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Yokohama Patch 12 Hot Fix 1b\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Yokohama Patch 13\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Zurich Patch 7b\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Zurich Patch 9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Brazil EA\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"Brazil GA\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\\n\\n\\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\\n\\n\\n\\n\\nFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\\n\\n\\n\\n\\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003e\u003cbr\u003e\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cspan\u003eWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.\u003c/span\u003e\u003c/div\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"303448ea-6ef3-4077-ad29-5c9bf253c375\", \"shortName\": \"SN\", \"dateUpdated\": \"2026-07-13T18:20:50.748Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-6875\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-14T03:55:45.828Z\", \"dateReserved\": \"2026-04-22T18:21:24.368Z\", \"assignerOrgId\": \"303448ea-6ef3-4077-ad29-5c9bf253c375\", \"datePublished\": \"2026-07-13T18:17:27.508Z\", \"assignerShortName\": \"SN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-6875

Vulnerability from fkie_nvd - Published: 2026-07-13 19:17 - Updated: 2026-07-14 05:16

KEVIntel

Severity

9.5 (Critical) - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Summary

References

	URL	Tags
	psirt@servicenow.com	https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "ServiceNow AI Platform",
          "vendor": "ServiceNow",
          "versions": [
            {
              "lessThan": "Australia Patch 2",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Yokohama Patch 12 Hot Fix 1b",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Yokohama Patch 13",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Zurich Patch 7b",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Zurich Patch 9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Brazil EA",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "Brazil GA",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@servicenow.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\n\n\n\n\nFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\n\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so."
    }
  ],
  "id": "CVE-2026-6875",
  "lastModified": "2026-07-14T05:16:19.730",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.5,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "psirt@servicenow.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-6875",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-13T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-13T19:17:36.440",
  "references": [
    {
      "source": "psirt@servicenow.com",
      "url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947"
    }
  ],
  "sourceIdentifier": "psirt@servicenow.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-8JW2-7QP4-V2JJ

Vulnerability from github – Published: 2026-07-13 21:31 – Updated: 2026-07-13 21:31

Details

ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.

Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Severity

9.5 (Critical)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-6875"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T19:17:36Z",
    "severity": "CRITICAL"
  },
  "details": "ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.\n\n\nServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.\n\n\n\n\nFurther, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.\n\n\n\n\nWe recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.",
  "id": "GHSA-8jw2-7qp4-v2jj",
  "modified": "2026-07-13T21:31:24Z",
  "published": "2026-07-13T21:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6875"
    },
    {
      "type": "WEB",
      "url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

WID-SEC-W-2026-2302

Vulnerability from csaf_certbund - Published: 2026-07-13 22:00 - Updated: 2026-07-20 22:00

Summary

ServiceNow AI Platform: Schwachstelle ermöglicht Codeausführung

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Die ServiceNow AI Platform ist eine Sammlung von KI-gestützten Funktionen, die in die ServiceNow-Plattform integriert sind, um Arbeitsabläufe zu automatisieren und Entscheidungen zu verbessern.

Angriff: Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ServiceNow AI Platform ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2026-6875

Affected products

Known affected 7 products

Product	Identifier	Version	Remediation
ServiceNow AI Platform <Zurich Patch 9 ServiceNow / AI Platform		<Zurich Patch 9
ServiceNow AI Platform <Yokohama Patch 12 Hot Fix 1b ServiceNow / AI Platform		<Yokohama Patch 12 Hot Fix 1b
ServiceNow AI Platform <Yokohama Patch 13 ServiceNow / AI Platform		<Yokohama Patch 13
ServiceNow AI Platform <Brazil EA ServiceNow / AI Platform		<Brazil EA
ServiceNow AI Platform <Brazil GA ServiceNow / AI Platform		<Brazil GA
ServiceNow AI Platform <Australia Patch 2 ServiceNow / AI Platform		<Australia Patch 2
ServiceNow AI Platform <Zurich Patch 7b ServiceNow / AI Platform		<Zurich Patch 7b

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://support.servicenow.com/kb?id=kb_article_v…	external
https://www.cve.org/CVERecord?id=CVE-2026-6875	external
https://slcyber.io/research-center/smashing-the-s…	external
https://www.linkedin.com/feed/update/urn:li:activ…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Die ServiceNow AI Platform ist eine Sammlung von KI-gest\u00fctzten Funktionen, die in die ServiceNow-Plattform integriert sind, um Arbeitsabl\u00e4ufe zu automatisieren und Entscheidungen zu verbessern.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in ServiceNow AI Platform ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2302 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2302.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2302 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2302"
      },
      {
        "category": "external",
        "summary": "ServiceNow vom 2026-07-13",
        "url": "https://support.servicenow.com/kb?id=kb_article_view\u0026sysparm_article=KB3137947"
      },
      {
        "category": "external",
        "summary": "CVERecord vom 2026-07-13",
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-6875"
      },
      {
        "category": "external",
        "summary": "Searchlight Cyber: \"Smashing the ServiceNow Sandbox\" vom 2026-07-14",
        "url": "https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/"
      },
      {
        "category": "external",
        "summary": "Linkedin Eintrag",
        "url": "https://www.linkedin.com/feed/update/urn:li:activity:7484239053064876032/"
      }
    ],
    "source_lang": "en-US",
    "title": "ServiceNow AI Platform: Schwachstelle erm\u00f6glicht Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2026-07-20T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-21T06:32:57.594+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2302",
      "initial_release_date": "2026-07-13T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-13T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "2",
          "summary": "PoC aufgenommen"
        },
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "3",
          "summary": "Aktive Ausnutzung gemeldet"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cBrazil EA",
                "product": {
                  "name": "ServiceNow AI Platform \u003cBrazil EA",
                  "product_id": "T056419"
                }
              },
              {
                "category": "product_version",
                "name": "Brazil EA",
                "product": {
                  "name": "ServiceNow AI Platform Brazil EA",
                  "product_id": "T056419-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:servicenow:ai_platform:brazil_ea"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cBrazil GA",
                "product": {
                  "name": "ServiceNow AI Platform \u003cBrazil GA",
                  "product_id": "T056420"
                }
              },
              {
                "category": "product_version",
                "name": "Brazil GA",
                "product": {
                  "name": "ServiceNow AI Platform Brazil GA",
                  "product_id": "T056420-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:servicenow:ai_platform:brazil_ga"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cAustralia Patch 2",
                "product": {
                  "name": "ServiceNow AI Platform \u003cAustralia Patch 2",
                  "product_id": "T056421"
                }
              },
              {
                "category": "product_version",
                "name": "Australia Patch 2",
                "product": {
                  "name": "ServiceNow AI Platform Australia Patch 2",
                  "product_id": "T056421-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:servicenow:ai_platform:australia_patch_2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cZurich Patch 7b",
                "product": {
                  "name": "ServiceNow AI Platform \u003cZurich Patch 7b",
                  "product_id": "T056422"
                }
              },
              {
                "category": "product_version",
                "name": "Zurich Patch 7b",
                "product": {
                  "name": "ServiceNow AI Platform Zurich Patch 7b",
                  "product_id": "T056422-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:servicenow:ai_platform:zurich_patch_7b"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cZurich Patch 9",
                "product": {
                  "name": "ServiceNow AI Platform \u003cZurich Patch 9",
                  "product_id": "T056423"
                }
              },
              {
                "category": "product_version",
                "name": "Zurich Patch 9",
                "product": {
                  "name": "ServiceNow AI Platform Zurich Patch 9",
                  "product_id": "T056423-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:servicenow:ai_platform:zurich_patch_9"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cYokohama Patch 12 Hot Fix 1b",
                "product": {
                  "name": "ServiceNow AI Platform \u003cYokohama Patch 12 Hot Fix 1b",
                  "product_id": "T056424"
                }
              },
              {
                "category": "product_version",
                "name": "Yokohama Patch 12 Hot Fix 1b",
                "product": {
                  "name": "ServiceNow AI Platform Yokohama Patch 12 Hot Fix 1b",
                  "product_id": "T056424-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:servicenow:ai_platform:yokohama_patch_12_hot_fix_1b"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cYokohama Patch 13",
                "product": {
                  "name": "ServiceNow AI Platform \u003cYokohama Patch 13",
                  "product_id": "T056425"
                }
              },
              {
                "category": "product_version",
                "name": "Yokohama Patch 13",
                "product": {
                  "name": "ServiceNow AI Platform Yokohama Patch 13",
                  "product_id": "T056425-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:servicenow:ai_platform:yokohama_patch_13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AI Platform"
          }
        ],
        "category": "vendor",
        "name": "ServiceNow"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6875",
      "product_status": {
        "known_affected": [
          "T056423",
          "T056424",
          "T056425",
          "T056419",
          "T056420",
          "T056421",
          "T056422"
        ]
      },
      "release_date": "2026-07-13T22:00:00.000+00:00",
      "title": "CVE-2026-6875"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-6875 (GCVE-0-2026-6875)

KEVIntel

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

FKIE_CVE-2026-6875

GHSA-8JW2-7QP4-V2JJ

WID-SEC-W-2026-2302

Tags

Sightings

Nomenclature