Sandbox Escape Remote Code Execution in ServiceNow AI Platform (CVE-2026-6875)

Your instance is affected if it runs below the fixed patch level ServiceNow published on 13 July 2026. CVE-2026-6875 is a sandbox escape — an unauthenticated user breaks out of the server-side script sandbox and executes code on the platform itself — rated CVSS 9.5 Critical, higher than the February sandbox flaw because the escape reaches past the sandbox boundary. Hosted instances received the fix automatically: unauthenticated traffic is enforced the moment you upgrade, while enforcement for authenticated traffic phases in over roughly four weeks.

What This Is

CVE-2026-6875 is a critical remote code execution vulnerability in the ServiceNow AI Platform, disclosed by ServiceNow on 2026-07-13 in advisory KB3137947. The root cause is a sandbox escape in the platform's server-side script execution environment: under certain conditions an unauthenticated user can break out of the script sandbox and execute code within the ServiceNow platform. NVD and the GitHub Advisory Database classify it as CWE-94 (improper control of code generation / code injection), rated CVSS v4.0 9.5 (Critical) with an unauthenticated network vector and high attack complexity.

ServiceNow addressed the flaw by deploying a security update to hosted instances and issuing equivalent updates to self-hosted customers and partners. The remediation ships as Guarded Script — the Server-Side Sandbox Runtime Replacement described in KB2944435 — which hardens how server-side scripts are executed. ServiceNow has not published the specific AI Platform component or the exact trigger conditions, so this article treats the mechanism at the class level (sandbox escape) rather than reproducing an exploit.

Why This Is Dangerous

An attacker exploiting an unauthenticated sandbox-escape RCE needs no credentials and no user interaction, only network reachability to the instance:

1. Discovery. An attacker enumerates internet-facing ServiceNow instances (certificate transparency, *.service-now.com and custom-domain subdomain enumeration, or fingerprinting the login page).
2. Exploitation. Under the vulnerable conditions, the attacker submits input that escapes the server-side script sandbox, causing code to run in the platform's execution context — without authenticating.
3. Post-exploitation. Code execution inside the platform lets an attacker create rogue privileged accounts, plant persistence in server-side logic (Business Rules, Script Includes, Scheduled Jobs), read or exfiltrate records from sensitive tables (CMDB, HR, ITSM, secrets stored in records), or pivot to integrated systems through stored MID Server credentials and OAuth tokens.
4. Impact. Full confidentiality, integrity, and availability compromise of the instance and of downstream systems reachable from it.

The AI Platform surface is high-value because it processes unstructured input and drives automated workflows, and because the unauthenticated vector means guest (pre-login) traffic is in scope until the instance is upgraded.

How to Detect

The authoritative check is patch level: compare your instance build against the fixed versions in KB3137947. The build identifier is exposed by two properties that exist on every instance regardless of plugin state.

// Read-only, safe for production
// Run in Scripts - Background (admin). Reports the build identifier so you can
// compare it against the fixed versions listed in ServiceNow KB3137947.
// Note: glide.builddate is NOT reliable for programmatic patch-level comparison
// (see NIS2-21); use the build tag + the KB matrix for the authoritative answer.
var buildTag = gs.getProperty('glide.buildtag', 'UNKNOWN');
var buildDate = gs.getProperty('glide.builddate', 'UNKNOWN');

gs.info('Build tag: ' + buildTag);
gs.info('Build date: ' + buildDate);
gs.info('CVE-2026-6875 fixed in: Brazil EA/GA, Australia Patch 2, ' +
        'Zurich Patch 7b/Patch 9, Yokohama Patch 12 Hot Fix 1b/Patch 13 (KB3137947).');

If the build predates the fixed version for your family release, the instance is exposed. Because the flaw is unauthenticated, also look for post-exploitation indicators in the window before you patched:

// Read-only, safe for production
// Surfaces admin-role grants and server-side script changes since disclosure.
// These are indicators for review, not proof of exploitation — corroborate
// against sys_audit and your SIEM before drawing a conclusion.
var since = '2026-07-13 00:00:00';

var roles = new GlideRecord('sys_user_has_role');
roles.addQuery('role.name', 'admin');
roles.addQuery('sys_created_on', '>=', since);
roles.query();
while (roles.next()) {
    gs.info('Admin grant since disclosure: user=' + roles.getDisplayValue('user') +
            ' created=' + roles.getValue('sys_created_on'));
}

var si = new GlideRecord('sys_script_include');
si.addQuery('sys_updated_on', '>=', since);
si.orderByDesc('sys_updated_on');
si.setLimit(50);
si.query();
while (si.next()) {
    gs.info('Script Include changed since disclosure: ' + si.getValue('name') +
            ' by=' + si.getValue('sys_updated_by') +
            ' updated=' + si.getValue('sys_updated_on'));
}

Remediation

1. Confirm your patch status against KB3137947. Run the build-tag script above and compare against the fixed versions: Brazil EA / Brazil GA, Australia Patch 2, Zurich Patch 7b or Patch 9, Yokohama Patch 12 Hot Fix 1b or Patch 13.

   Mitigates: Attack Scenario 2 (Exploitation) — closes the unauthenticated code-execution path entirely on a fixed build.

2. Hosted (ServiceNow-managed) instances: ServiceNow deployed the update automatically. If your build predates the fixed version, raise a case via Now Support to confirm patch application.

3. Self-hosted / partner instances: download and apply the patch for your family release from Now Support, or upgrade to the earliest fixed release listed above. Do not defer — the vector is unauthenticated.

   Mitigates: Attack Scenario 1 (Discovery) → Scenario 2 — removes the exposed condition that internet-facing enumeration targets.

4. Review the Incompatible Guarded Scripts list after upgrading. Guarded Script (KB2944435) changes how complex server-side scripts run: scripts using variables, if/else logic, loops, or multiple statements must be moved into a Script Include. Simple expressions, client-side JavaScript, and code already inside Script Includes are unaffected. On hosted instances, guest (unauthenticated) traffic is enforced immediately and authenticated-traffic enforcement phases in automatically over ~4 weeks; on-premises instances begin detection automatically but advance each enforcement phase manually.

5. If exposure indicators are found, rotate secrets and preserve evidence. Rotate OAuth client secrets, integration credentials, and MID Server passwords, and preserve sys_audit / syslog_transaction / sysevent logs for the exposure window.

   Mitigates: Attack Scenario 3 (Post-exploitation) — invalidates credentials an attacker may have captured and preserves the record needed for a reporting determination.

Regulatory Impact

• NIS2 Art.21§2(a) — an unpatched, unauthenticated critical RCE is a material gap in the risk-analysis and information-system-security policies expected of essential/important entities.
• NIS2 Art.21§2(e) — security in acquisition, development and maintenance obliges prompt handling of vulnerability disclosures and patches; deferring this patch is a direct control failure.
• NIS2 Art.23§1 — if exploitation is confirmed, a significant-incident notification to the CSIRT/competent authority applies. Whether the flaw was exercised before patching is an evidentiary question, not automatically a reportable incident.
• DORA Art.9§1 / Art.17§1 — financial entities must maintain preventive protection (patching) and an ICT-incident management process capable of detecting and reporting exploitation of this class.
• ISO 27001:2022 A.8.8 — management of technical vulnerabilities: an available vendor patch left unapplied is an audit finding against this control.
• GDPR Art.32 — if personal data held in the instance was accessible through exploitation, the security-of-processing obligation (and the Art.33 72-hour breach-notification clock) is engaged.

Expert Notes

• The build tag, not glide.builddate, is the reliable signal. glide.builddate exists on every instance but is not a dependable patch-level discriminator (NIS2 Article 21 — Complete ServiceNow Security Measures Mapping documents this); use glide.buildtag plus the KB3137947 matrix, or confirm with Now Support, for the authoritative answer.
• This is a distinct CVE from Remote Code Execution in ServiceNow AI Platform Sandbox (CVE-2026-0542) (CVE-2026-0542). Both are AI Platform sandbox RCEs, but CVE-2026-0542 (February 2026, KB2693566, CWE-653, CVSS 9.2) and CVE-2026-6875 (July 2026, KB3137947, CWE-94, CVSS 9.5) are separate advisories with separate fix matrices — do not treat a patch for one as covering the other.
• The technical mechanism is deliberately undisclosed. ServiceNow named neither the component nor the trigger, and reported no known exploitation. Because no verified exploitation fingerprint exists, the Nowisor exposure check treats "was this exercised?" as INVESTIGATE/DORMANT rather than asserting a verdict — patch status is answerable; exploitation is not, without instance-side evidence.
• Guest traffic is the immediate concern. Because the vector is unauthenticated and Guarded Script enforces guest traffic first, an instance that is internet-facing and behind on patches is the highest-priority remediation, ahead of internal-only instances.