ServiceNow AI Platform is a popular software utilized by organizations worldwide for automating digital workflows and enhancing service delivery through AI capabilities. This platform is extensively used in industries where efficient process automation is critical to improving service management, IT operations, and customer engagement. ServiceNow is often deployed across various sectors such as healthcare, finance, telecom, and government, allowing users to streamline operations, manage incidents, and facilitate communication between departments. Its robust integration capabilities make it an ideal choice for connecting numerous enterprise applications, ensuring data consistency, and promoting operational efficiency. Due to its expansive use and integration within organizational infrastructures, safeguarding its functionality from vulnerabilities like RCE is paramount to maintaining business continuity.
The Remote Code Execution (RCE) vulnerability described targets the ServiceNow AI Platform by exploiting its JavaScript sandbox escape. Before patching, certain releases like Brazil, Australia, Zurich, and Yokohama were susceptible to unauthorized code execution if accessed by cyber attackers. This vulnerability allows malicious actors to bypass authorization mechanisms, potentially leading to severe security breaches. The flaw lies within the /assessment_thanks.do endpoint, which inadequately handles certain JavaScript-prefixed values allowing them to be executed in an unintended context. Such vulnerabilities are targeted due to their potential to completely compromise control over the affected systems, making them a significant threat when left unpatched.
Technical details of the vulnerability indicate the involvement of the sysparm_assessable_type parameter within the ServiceNow platform. By delivering inputs that exploit the JavaScript sandbox escape, external attackers can manipulate input values like Object.defineProperty and Class.create.constructor. By appending these values through the gs.include('ItemViewElementsProvider') path, attackers can bypass existing sandbox limitations and invoke arbitrary GlideController code execution. This allows the attacker to perform unauthorized operations, which the platform typically restricts, giving them unrestricted command execution capabilities on the system.
Exploitation of this vulnerability poses significant security risks to organizations utilizing the affected ServiceNow releases. Unauthorized code execution can allow attackers to access sensitive data within database tables, alter system settings, and even create administrator accounts. Furthermore, it enables potential shell command execution on connected MID proxy servers, facilitating unauthorized access into internal networks, potentially leading to widespread data breaches, operational disruptions, and financial losses if leveraged effectively by malicious actors.
REFERENCES
- https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/
- https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
- https://nvd.nist.gov/vuln/detail/CVE-2026-6875
- https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
- https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit
- Apply all recommended security updates provided by ServiceNow for affected versions.
- Consult and implement additional hardening strategies outlined in ServiceNow's security best practices.
- Regularly monitor and evaluate network traffic for unusual activity to detect potential exploitation attempts.
- Restrict access to critical endpoints and employ firewalls or intrusion detection/prevention systems to mitigate unauthorized access.
- Conduct thorough security audits periodically to detect and rectify any existing weaknesses or unauthorized modifications.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →