Hackers Start Breaking Into ServiceNow AI Platform Through Critical Flaw CVE-2026-6875

Key points

• Attackers began exploiting a critical ServiceNow AI Platform flaw, tracked as CVE-2026-6875, in live attacks starting Friday, according to threat intelligence firm Defused.
• The bug lets unauthenticated attackers escape the platform's sandbox and run their own code on the server, with no login required.
• ServiceNow patched hosted instances and released fixes for self-hosted customers on July 13, one week before exploitation was observed.
• ServiceNow's AI Platform runs more than 100 billion workflows a year and is used by 85% of Fortune 500 companies.
• ServiceNow's public advisory still states it is not aware of active exploitation.

Criminals are now attacking a serious flaw in the ServiceNow AI Platform, the enterprise software formerly called the Now Platform that large companies use to run internal workflows. We first flagged this vulnerability on 15 July in our story "Fortinet, Ivanti, and ServiceNow patch 15 flaws, including a critical no-login attack on ServiceNow's AI platform", which noted the flaw was rated 9.5 out of 10 in severity.

The bug is tracked as CVE-2026-6875. It lets an attacker with no account reach a sensitive part of the software and run their own commands on the server. No password, no login, no foothold needed first.

Defused said on Saturday it's seeing this happen in the wild. First attempts landed on Friday, days after ServiceNow released a fix. BleepingComputer also reported the exploitation activity.

How did the attackers get in?

They hit a specific web address inside the ServiceNow software, /assessment_thanks.do, which was never meant to accept commands from strangers. Searchlight Cyber, the security firm that found the flaw and reported it to ServiceNow on April 1, flagged that address as the vulnerable entry point.

Once inside, attackers break out of the sandbox, a walled-off area meant to keep untrusted code from touching the rest of the system. Defused says the live attacks reach the same result as Searchlight's proof-of-concept but take a different technical path to get there.

ServiceNow describes the attack as high complexity, meaning it takes real skill to pull off. That hasn't stopped it.

What has ServiceNow done?

The company patched its own hosted customers automatically. For customers who run ServiceNow on their own servers, it released security updates on July 13. ServiceNow's telling any customer who hasn't installed those updates to do so immediately.

At time of writing, the official advisory still says ServiceNow is "not currently aware of exploitation against ServiceNow instances." That hasn't been updated to reflect the Defused findings. A ServiceNow spokesperson hadn't commented publicly on the exploitation reports.

This isn't the first uncomfortable month for the company. In June, ServiceNow privately told customers that attackers had queried data from customer instances through a separate unauthenticated flaw in one of its interfaces, then later tied that activity to bug bounty researchers rather than criminals.

Why does this matter to ordinary businesses?

ServiceNow isn't niche. The company says its AI Platform handles more than 100 billion workflows a year and powers over 100,000 enterprise AI apps across 85% of Fortune 500 companies. HR records, IT tickets and customer service logs for a large chunk of global business sit inside these instances.

A pre-authentication code execution flaw in that environment is about as bad as vulnerabilities get. An attacker who lands code on a ServiceNow server can potentially read data from any workflow that instance handles.

Should you worry?

If you run a self-hosted ServiceNow instance, apply the July 13 patches now. Check your web server logs for requests to /assessment_thanks.do from unusual or foreign sources since Friday. Rotate any credentials or API tokens inside that instance if you find signs of access.

Customers on ServiceNow's hosted service should confirm with their account team that the fix is in place and ask for the date it was applied in writing.

The advisory gap is the thing worth watching here: a vendor publicly denying awareness of exploitation while a threat intelligence firm posts live evidence isn't a communication failure, it's a policy choice, and affected customers deserve better.