CVE-2026-6875Sandbox Escape in ServiceNow AI Platform
Updated under an hour ago ()
Does this affect you?
It affects ServiceNow AI Platform. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
- CVSS
- 9.5 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Weakness (CWE)
- CWE-94
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- SN
- NVD analysis
- Awaiting Analysis
- Record last updated
- Aug 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
ServiceNow ServiceNow AI Platform servicenow:ai_platform (from the name) | before Australia Patch 2; before Yokohama Patch 12 Hot Fix 1b; before Yokohama Patch 13; before Zurich Patch 7b; before Zurich Patch 9; before Brazil EA; before Brazil GA | CNA record |
References
- https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.