ServiceNow CVE-2026-6876

What it is. A flaw in the Now Platform's server-side script sandbox that lets code break out of the boundary the sandbox exists to enforce and run with more reach than intended. ServiceNow rates it 8.7 out of 10 — high, and the lowest of the four CVEs in its August 2026 batch.

Are you exposed? Any Xanadu, Yokohama, Zurich or Australia instance that has not reached the patch levels listed below. For a direct answer, use the Check your instance link further down this page and enter your release and patch level.

On Washington DC or older, ServiceNow published no fix — it patches only releases still in support. That is not the same as being unaffected. No fixed version exists for those releases, so nothing on this page can clear you, and the instance should be treated as exposed until it is upgraded.

What to do. Patch — and read the pattern below, because for this class of flaw the patch is the smaller half of the remediation.

Has it been used? Not visibly. There is no CISA KEV entry, no public exploit in the sources tracked here, and ServiceNow reports no evidence of malicious exploitation.

ServiceNow's own description and its own score disagree on whether a login is needed. The advisory text in KB3152244 and in the CVE Record both say the issue could allow an unauthenticated user to execute arbitrary code. ServiceNow's CVSS 4.0 vector for the same CVE reads AV:N/AC:L/AT:N/PR:L/UI:N — privileges required: low, meaning the attacker needs some authenticated access. Those cannot both be true. The 8.7 is computed from the vector, and a PR:N vector with identical impact metrics would have scored materially higher, so the vector is the artifact the score agrees with. Plan remediation as though the prose is right, and do not offer login as a mitigating control to an auditor on the strength of PR:L. Open question: needs ServiceNow follow-up.

The pattern worth seeing. This is the third sandbox escape ServiceNow has published for this containment boundary in twenty-two months, after CVE-2024-8923 (October 2024, CVSS 9.3) and CVE-2026-6875 (July 2026, CVSS 9.5, ServiceNow AI Platform). Its answer to the second was not another patch to the sandbox but a replacement of the runtime — Guarded Script, the Server-Side Sandbox Runtime Replacement (KB2944435). Read as a sequence rather than three separate advisories, the conclusion is that an instance still permitting complex inline server-side script is carrying the risk the whole sequence is about, whatever its current patch level.

For analysts. The impact triple is SC:N/SI:N/SA:N — alone among the four August 2026 CVEs, ServiceNow confined the consequences to the vulnerable system rather than to subsequent ones. A sandbox escape is also a second-stage capability: its value compounds whatever access an attacker already holds, which is consistent with the PR:L vector. Chained behind any of the three pre-authentication criticals disclosed in the same batch, that privilege requirement stops being a barrier.

What this page can tell you. The patch levels below were checked by a person against ServiceNow's KB3152244 on 2026-08-29, so the free check gives you a straight patched-or-affected answer from your release and patch level. Nobody has written a detection rule for this CVE yet, so the paid log check will tell you it could not look rather than guess — it never reports an attack it did not actually see.