Public PoC released for Critical ServiceNow Sandbox RCE Vulnerability

ServiceNow has released security updates for a critical vulnerability in its AI platform after researchers published a proof of concept demonstrating pre-authentication remote code execution.

The flaw, tracked as CVE-2026-6875, is a sandbox escape issue that could allow an unauthenticated attacker to run code within a vulnerable ServiceNow instance.

Researchers from Assetnote at Searchlight Cyber disclosed the vulnerability in a technical report titled “Smashing the ServiceNow Sandbox: Pre-Authentication RCE.”

According to Searchlight Cyber researchers, successful exploitation could lead to a full compromise of a ServiceNow instance, including access to data stored in tables, the ability to create administrator accounts, and the potential to execute commands on connected MID Server proxy systems.

ServiceNow published advisory KB3137947 on July 13, 2026, confirming that CVE-2026-6875 affects the ServiceNow AI platform.

The company said it deployed protections to hosted instances and released updates for self-hosted customers and partners. ServiceNow stated that it is not aware of active exploitation in the wild.

PoC for ServiceNow Sandbox RCE

The public PoC focuses on the platform’s GlideRecord query API, which is widely used by ServiceNow applications to retrieve and process table data.

Searchlight Cyber researchers found that some pre-authentication application paths passed user-controlled input into GlideRecord query functions. A special JavaScript query value could cause the supplied JavaScript to be evaluated before the query is executed.

ServiceNow already used a restricted script sandbox for such untrusted filter expressions. This sandbox blocks dangerous capabilities, including direct use of eval, dynamic function creation, arbitrary function declarations, and access to sensitive Java classes.

However, Assetnote found a way to bypass those restrictions through the platform’s script-include mechanism. The Searchlight Cyber researchers discovered that the gs.include() function loaded script libraries in a less restricted execution context.

By manipulating global JavaScript objects and properties used by included scripts, an attacker could cause attacker-controlled code to be compiled and executed outside the stricter sandbox.

The technique exploited changes to JavaScript object properties and function constructor behavior to transition from restricted script execution to a more privileged ServiceNow scripting context.

Once outside the sandbox, the attacker could interact with ServiceNow’s internal APIs with far fewer restrictions. The researchers said this could enable database access, administrative actions, and interaction with configured MID Servers.

MID Servers are commonly deployed within enterprise networks to connect ServiceNow cloud instances with internal systems, increasing the potential impact of a compromise.

Assetnote reported the issue to ServiceNow on April 1, 2026. ServiceNow reportedly introduced an immediate cloud-side mitigation within 24 hours by preventing changes to critical JavaScript functions.

The vendor later issued broader fixes addressing the underlying sandbox weakness. The company has also introduced Guarded Script protections, designed to reduce the attack surface of sandboxed code.

Under this model, simple expressions and basic function calls continue to work, while complex server-side scripts using variables, conditionals, loops, assignments, or multiple statements must be moved into Script Includes.

CVE-2026-6875 is fixed in Brazil EA and Brazil GA, Australia Patch 2, Zurich Patch 7b and Patch 9, and Yokohama Patch 12 Hot Fix 1b and Patch 13. ServiceNow customers should urgently confirm that their instance is running a patched release and review the Incompatible Guarded Scripts list after upgrading.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.