A critical remote code execution vulnerability that was recently patched in the ServiceNow AI platform is reportedly being exploited in the wild.
The security hole is tracked as CVE-2026-6875 and it has been described as a sandbox escape issue that an unauthenticated attacker can exploit in certain circumstances to execute arbitrary code.
When it announced the availability of patches on July 14, ServiceNow said a security update addressing the vulnerability had been deployed to hosted instances. However, self-hosted customers have to install the patches themselves.
On the same day, cybersecurity firm Searchlight Cyber disclosed technical details and showed how the vulnerability can be exploited.
Threat intelligence firm Defused reported on July 18 that it had seen in-the-wild exploitation of CVE-2026-6875, leveraging information Searchlight Cyber had released.
Defused initially said the exploit reached the same outcome as Searchlight’s proof-of-concept but through a slightly different method. On Monday, however, the firm issued a correction, saying that closer analysis showed the captured payload was in fact identical to Searchlight Cyber’s own.
The vendor’s initial advisory stated it had no knowledge of active exploitation, and as of this writing, that advisory has not been updated to reflect otherwise.
“ServiceNow is aware of a cybersecurity company’s recent publication regarding exploitation activity associated with a previously disclosed security vulnerability, identified as CVE-2026-6875,” a ServiceNow spokesperson told SecurityWeek. “Based on our investigation to date, we have not observed evidence that this activity is related to instances that ServiceNow hosts.”
“We have provided updates and patches designed to address this issue, and we encourage our self-hosted and ServiceNow-hosted customers to apply the relevant patches if they have not already done so. In addition, we will continue to work directly with customers who need assistance in applying the patches,” the spokesperson added.
There do not appear to be any other reports describing the exploitation of CVE-2026-6875, and there is a chance that the activity is being carried out by members of the cybersecurity industry seeking vulnerable systems.
ServiceNow informed customers last month of an exploited vulnerability, but the company later clarified that the exploitation had been attributed to security researchers rather than attackers.
ServiceNow vulnerabilities are not often exploited by threat actors. CISA’s KEV catalog currently includes only two flaws, both patched in 2024.
Related: SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Related: WP2Shell WordPress Vulnerabilities Exploited in the Wild
Related: Fresh SharePoint Vulnerability Exploited Soon After Disclosure
