CVE-2026-6875
NVD analysis in progress
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
What this means
- Exposure
- Exploitable remotely over the network, without authentication and with no action from the victim. The attack does require particular conditions, which makes it less systematic.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline. The impact spreads beyond the vulnerable component into other parts of the system.
- Weakness
- The application interprets attacker-supplied code, which then runs with its privileges.
- Likelihood
- Its EPSS score makes exploitation likely within the next thirty days.
What to doPatch without waiting for the next scheduled cycle. Start with the instances exposed to the internet.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.