# Three Enterprise Vendors Patch Critical Flaws as ServiceNow AI RCE Threatens Millions


## The Threat


Fortinet, Ivanti, and ServiceNow released a wave of critical security patches on Tuesday, addressing 15 vulnerabilities across enterprise infrastructure and AI platforms. The most urgent threat is a remote code execution vulnerability in ServiceNow's AI platform that requires no authentication—meaning any attacker on the internet can potentially take control of affected deployments without credentials or prior access.


ServiceNow's flaw (CVE-2026-6875) represents a critical failure in the AI platform's input validation, allowing attackers to inject and execute arbitrary code directly. Since ServiceNow AI handles sensitive business logic, automation workflows, and data processing for thousands of organizations worldwide, successful exploitation could grant attackers complete control over critical business processes. The company has already deployed patches to its hosted infrastructure, but organizations running self-hosted deployments remain vulnerable until they apply updates.


Alongside ServiceNow's critical vulnerability, Ivanti's data aggregation tool Xtraction and Fortinet's extensive product portfolio contain vulnerabilities ranging from information disclosure to authenticated code execution. Ivanti's issues allow attackers to redirect users to malicious sites and read sensitive files from affected systems. Fortinet's 12 vulnerabilities span authentication bypass, command injection, and filesystem manipulation—compounding the risk for organizations that rely on Fortinet's edge security, access control, and threat detection products. Together, these patches signal a broader pattern of vendor-side vulnerabilities that require urgent industry attention.


## Severity and Impact


| Vulnerability | Vendor | Product | CVE | CVSS Score | Attack Vector | Authentication | CWE |

|---|---|---|---|---|---|---|---|

| AI Platform RCE | ServiceNow | ServiceNow AI | CVE-2026-6875 | 9.5 (Critical) | Network | None Required | CWE-94 |

| Path Traversal | Ivanti | Xtraction | CVE-2026-14903 | High | Network | Possibly Required | CWE-22 |

| Open Redirect | Ivanti | Xtraction | CVE-2026-14902 | Medium | Network | None Required | CWE-601 |

| Information Disclosure (Multiple) | Fortinet | FortiAuthenticator, FortiSandbox | Multiple | High | Network | Not Required (FortiSandbox) | CWE-200 |

| Command Execution & Memory Leaks | Fortinet | FortiOS, FortiProxy, FortiSASE, Others | Multiple | Medium–High | Network | Varies | CWE-400, CWE-78 |


## Affected Products


ServiceNow

  • ServiceNow AI platform (all versions prior to patch deployment)

    • Ivanti

  • Xtraction (affected versions to be specified in security advisory)

    • Fortinet

  • FortiOS
  • FortiProxy
  • FortiSASE
  • FortiSIEM
  • FortiClient EMS
  • FortiAuthenticator
  • FortiPAM
  • FortiSwitch Manager
  • FortiSwitch-Manager Agentless SSL-VPN
  • FortiSandbox

    • ## Mitigations


    Immediate Actions:

  • ServiceNow customers: Apply patches to self-hosted deployments immediately. Verify that hosted instances have been updated by contacting your ServiceNow account team. Audit workflow logs and AI platform activity logs for evidence of exploitation attempts.
  • Ivanti customers: Deploy patches for Xtraction as soon as they become available. Restrict network access to Xtraction instances using firewall rules and implement IP whitelisting where possible. Monitor for suspicious redirect behaviors in user sessions.
  • Fortinet customers: Prioritize patching FortiAuthenticator and FortiSandbox due to their critical security roles. Review and rotate API keys used for AD Connector integration. Apply patches to FortiOS, FortiProxy, and FortiSASE in sequence to avoid service disruption.

    • Longer-term Hardening:

  • Implement network segmentation to restrict lateral movement if any platform is compromised.
  • Enable verbose logging on all three platforms and centralize logs to a SIEM for threat detection.
  • Conduct code review of custom workflows and automation rules on ServiceNow to identify any that could be abused by an attacker with execution privileges.
  • Perform vulnerability scanning on internal deployments to identify systems still missing patches 72 hours after release.
  • For FortiSandbox, restrict VNC server access to trusted administrative subnets only.

    • ## References


  • [ServiceNow Security Advisory - CVE-2026-6875](https://www.servicenow.com/security)
  • [Ivanti Security Bulletin - Xtraction Vulnerabilities](https://www.ivanti.com/security)
  • [Fortinet Security Advisories - Multiple Products](https://www.fortinet.com/security)
  • [SecurityWeek Coverage](https://www.securityweek.com)

    • ---


    ## HackWire Analysis


    The convergence of three major vendor patches in a single day underscores a troubling reality: critical vulnerabilities are surfacing faster than organizations can patch them. ServiceNow's unauthenticated RCE is particularly alarming because it exposes the AI platform to the entire internet—no VPN bypass, no social engineering, no low-severity chain needed. An attacker simply sends a malicious request and gains code execution. For organizations with hundreds of ServiceNow instances across departments, this means the vulnerability surface is already massive, and many self-hosted customers won't even know they're exposed until attackers actively scan for the flaw.


    What's instructive here is the pattern: all three vendors are releasing patches for vulnerabilities discovered through their own security research, not from active exploitation reports. This is good news in the short term (no zero-day chaos), but it also means vulnerability disclosure is increasingly dependent on vendor discipline, not external security research or bug bounty programs catching flaws first. Organizations that rely on external threat intelligence to prioritize patches are flying blind.


    The Fortinet vulnerability bundle is worth special scrutiny. Twelve separate CVEs across ten products suggests either a sweeping code review that uncovered systemic issues or a concerning lack of input validation hygiene across the portfolio. The combination of authentication bypass, command injection, and file system deletion capabilities creates a nightmare scenario for incident responders: a single compromised FortiAuthenticator instance could lead to lateral movement across the entire Fortinet-protected network.


    For defenders: patch ServiceNow within 48 hours if you run self-hosted deployments, not 30 days. Audit your Fortinet instances for abnormal API key usage and check FortiSandbox VNC logs. This patch cycle is not a routine Tuesday—treat it as emergency maintenance.


    — HackWire Editorial


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)