Exploitation of ServiceNow Vulnerability Seen Days After Disclosure

The ServiceNow AI platform vulnerability tracked as CVE-2026-6875 can be exploited for remote code execution. The post Exploitation of ServiceNow Vulnerability Seen Days After Disclosure appeared first on SecurityWeek .

The article reports that CVE-2026-6875, a critical remote code execution sandbox-escape vulnerability in the ServiceNow AI platform, is being exploited in the wild only days after public disclosure. According to ServiceNow and independent analyses, the flaw allows an unauthenticated attacker to send crafted requests (e.g., to /assessment_thanks.do) to escape the AI sandbox and execute server-side code with broad access to the ServiceNow environment and potentially connected systems.[1][2][6] This creates a high-impact SaaS AI risk: compromise of a widely used AI-enabled SaaS platform can lead to data exfiltration, workflow manipulation, creation of rogue admin accounts, and pivoting into downstream integrations.[2][3] From a RealGround perspective, organizations should treat this as an AI supply-chain and SaaS AI exposure issue—rapidly validate patching, restrict AI endpoints, and use AI-focused red teaming and readiness assessments to test for residual RCE paths, misconfigurations, and over-privileged integrations flowing through ServiceNow's AI layer.