ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
CVE-2026-6875
Verified
Description
ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates "javascript:" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.
Severity
Critical
CVSS Score
9.5
Exploit Probability
1%
Affected Product
servicenow
Published Date
July 22, 2026
Template Author
pdteam, dhiyaneshdk
CVE-2026-6875.yaml
9.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-6875
CWE ID:
cwe-94
References
https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947https://nvd.nist.gov/vuln/detail/CVE-2026-6875https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit
Remediation Steps
Apply the latest security updates or upgrade to the patched release provided by ServiceNow.