A important distant code execution vulnerability that was lately patched within the ServiceNow AI platform is reportedly being exploited within the wild.
The safety gap is tracked as CVE-2026-6875 and it has been described as a sandbox escape concern that an unauthenticated attacker can exploit in sure circumstances to execute arbitrary code.
When it introduced the provision of patches on July 14, ServiceNow stated a safety replace addressing the vulnerability had been deployed to hosted cases. Nonetheless, self-hosted clients have to put in the patches themselves.
On the identical day, cybersecurity agency Searchlight Cyber disclosed technical particulars and confirmed how the vulnerability might be exploited.
Risk intelligence agency Defused reported on July 18 that it had seen in-the-wild exploitation of CVE-2026-6875, leveraging data Searchlight Cyber had launched.
Defused initially stated the exploit reached the identical end result as Searchlight’s proof-of-concept however by a barely completely different methodology. On Monday, nevertheless, the agency issued a correction, saying that nearer evaluation confirmed the captured payload was in actual fact an identical to Searchlight Cyber’s personal.
The seller’s preliminary advisory acknowledged it had no information of lively exploitation, and as of this writing, that advisory has not been up to date to mirror in any other case.
“ServiceNow is conscious of a cybersecurity firm’s latest publication relating to exploitation exercise related to a beforehand disclosed safety vulnerability, recognized as CVE-2026-6875,” a ServiceNow spokesperson advised SecurityWeek. “Based mostly on our investigation to this point, we have now not noticed proof that this exercise is said to cases that ServiceNow hosts.”
“We have now supplied updates and patches designed to deal with this concern, and we encourage our self-hosted and ServiceNow-hosted clients to use the related patches in the event that they haven’t already accomplished so. As well as, we’ll proceed to work straight with clients who want help in making use of the patches,” the spokesperson added.
There don’t seem like some other reviews describing the exploitation of CVE-2026-6875, and there’s a likelihood that the exercise is being carried out by members of the cybersecurity trade looking for susceptible programs.
ServiceNow knowledgeable clients final month of an exploited vulnerability, however the firm later clarified that the exploitation had been attributed to safety researchers moderately than attackers.
ServiceNow vulnerabilities are usually not typically exploited by menace actors. CISA’s KEV catalog presently consists of solely two flaws, each patched in 2024.
Associated: SonicWall Zero-Days Exploited to Ship Customized Malware for Weeks Earlier than Patch
Associated: WP2Shell WordPress Vulnerabilities Exploited within the Wild
Associated: Recent SharePoint Vulnerability Exploited Quickly After Disclosure
