Critical ServiceNow code execution flaw now exploited in attacks

# ServiceNow's Patch Was Seven Days Old When the Exploits Hit

Attackers didn't wait long. A critical pre-authentication remote code execution flaw in the ServiceNow AI Platform — the kind that lets an unauthenticated outsider escape a sandbox and run arbitrary code — was patched on July 13th. By Friday, July 18th, exploitation attempts were already landing in the wild. That's a seven-day window from patch to active attack.

CVE-2026-6875 is the kind of vulnerability that makes enterprise security teams go pale. No credentials required. High complexity, yes — but complexity is not a moat when nation-state actors and well-resourced criminal groups are on the other side of it.

## What the Flaw Actually Does

Searchlight Cyber discovered and reported the vulnerability back on April 1st, giving ServiceNow more than three months to prepare patches before public disclosure. The flaw allows unauthenticated attackers to escape ServiceNow's sandbox environment and achieve remote code execution on the platform itself.

The specific sink — /assessment_thanks.do — was documented in Searchlight's published proof-of-concept. That's the entry point. But here's the part that should alarm every defender who thought they knew what to watch for: Defused's researchers confirmed over the weekend that the attackers hitting this endpoint in the wild are using a different sandbox-escape gadget than the one in the public PoC.

Same destination. Different route.

That distinction matters enormously. Detection signatures and behavioral rules built around the published PoC may be blind to the variant now circulating. Organizations that deployed monitoring based on Searchlight's writeup and called it a day are not as covered as they think.

## The Advisory That Hasn't Caught Up With Reality

There is a notable gap between what independent researchers are seeing and what ServiceNow's official advisory currently says.

As of this writing, ServiceNow's advisory states the company is "not currently aware of exploitation against ServiceNow instances." Defused, meanwhile, posted on Saturday: "We are observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE."

This kind of lag between researcher observation and vendor acknowledgment is common, but it creates a dangerous credibility window. Security teams in organizations that defer to vendor advisories before taking action — a practice more widespread than anyone wants to admit — are currently sitting on an unpatched, actively exploited vulnerability while the vendor's official posture is still "we haven't seen it."

ServiceNow does tell customers to patch regardless. That's the right call. But the disconnect between observed reality and official advisory is worth naming.

## Who's Exposed and Why It's Not a Small Problem

ServiceNow's own numbers make the blast radius clear: the AI Platform processes more than 100 billion workflows per year and powers over 100,000 enterprise AI applications. Eighty-five percent of Fortune 500 companies run on it.

That is not a niche target. That is the connective tissue of enterprise operations — IT service management, HR workflows, security orchestration, procurement, compliance tracking. Organizations that have pushed AI automation into those workflows through the ServiceNow platform are running those processes on a platform that, until last week, had an unauthenticated RCE in it.

ServiceNow operates a hybrid deployment model. Hosted (cloud-managed) instances received patches automatically and earlier. Self-hosted instances — the ones where the enterprise controls the update cadence — required manual action, and the patches for those dropped July 13th. Any organization running self-hosted ServiceNow that hasn't patched yet is running a system with an actively exploited vulnerability.

## This Is the Second Incident in Two Months

Context that's easy to miss in the urgency of a zero-day response: this is not ServiceNow's first security rodeo this summer.

Last month, the company privately disclosed a separate incident in which attackers queried data from customer instances by exploiting an unauthenticated access flaw through a vulnerable API endpoint. ServiceNow later attributed that activity to security researchers and bug bounty activity rather than malicious actors — a characterization that some in the security community received skeptically — but the incident itself was real.

Two unauthenticated access vulnerabilities in two months, on a platform that sits inside the network of 85% of the Fortune 500, is a trend worth taking seriously. Enterprise workflow platforms are now clearly a target class. ServiceNow joins Microsoft SharePoint, Fortinet FortiSandbox, and Langflow on the recent list of enterprise infrastructure that has gone from patched to exploited in under two weeks.

## What Defenders Should Do Right Now

The short version: patch first, then verify.

For self-hosted instances, the priority is obvious — apply the July 13th security update immediately if it hasn't been done. For hosted instances, confirm with ServiceNow support that the patch has been applied; hosted deployments should be covered, but verify rather than assume.

Beyond patching:

---

## HackWire Analysis

The seven-day patch-to-exploitation window isn't the most alarming part of this story. The divergent exploit path is.

When Searchlight Cyber published their PoC documentation for CVE-2026-6875, they did what responsible researchers are supposed to do: gave the vendor months of lead time, then disclosed with enough technical detail for defenders to build detection. That disclosure is now a partial liability. The attackers in the wild are hitting the same pre-auth sink but reaching code execution through a different gadget chain. Every detection rule built on Searchlight's PoC — and there will have been many — is now pattern-matching for a specific technique while the actual attack moves through a different path.

This is not a criticism of Searchlight's disclosure. It's a structural problem with how the industry has come to rely on PoC-based detection. The PoC shows you one way to exploit a class of vulnerability. Attackers iterate. Defenders need to be thinking about the vulnerability class — unauthenticated code execution via sandbox escape — not just the specific gadget chain that got written up.

The broader trend is harder to dismiss: enterprise automation platforms are now a primary target class. ServiceNow, SharePoint, Fortinet's management planes, Langflow, Ivanti — the list of workflow and integration platforms that have gone from "patched" to "actively exploited" in the past 90 days is long. Attackers are not interested in your endpoints anymore. They want the platform that controls your endpoints. Once you're inside a ServiceNow instance at a Fortune 500 company, you're not just inside a ticketing system — you're inside the orchestration layer for IT, HR, security, and increasingly AI-driven business processes.

That's the target. And right now, it's being actively probed by people who found a different door than the one defenders were watching.

— HackWire Editorial

---

## Related Coverage