Breaking: ServiceNow Pre-Auth RCE Exploited — 21 July 2026
ServiceNow Pre-Auth RCE Now Exploited in the Wild
CVE-2026-6875, a CVSS 9.5 pre-authentication sandbox-escape remote code execution vulnerability in the ServiceNow AI Platform, is now being actively exploited. Threat intelligence firm Defused confirmed in-the-wild exploitation on Saturday, with attack payloads observed hitting the same pre-auth sink that researchers from Assetnote at Searchlight Cyber documented, but using a different sandbox-escape gadget chain than the published proof of concept. In other words, attackers reverse-engineered an independent exploitation path, which signals real capability and intent, not script-kiddie PoC chasing.
ServiceNow addressed the vulnerability for hosted instances in April and released patches for self-hosted instances on July 13. But exploitation was confirmed just one week after those self-hosted patches shipped, and attackers are already bypassing the specific gadget chain the published PoC used. ServiceNow has not yet formally acknowledged active exploitation in its advisory, stating it is "not currently aware of exploitation against ServiceNow instances," a position that is now contradicted by observed attack traffic. If you run ServiceNow self-hosted and have not patched since July 13, treat this as an active incident, not a future risk.
The scale of exposure is enormous. ServiceNow's AI Platform processes over 100 billion workflows annually and powers more than 100,000 enterprise applications at 85% of Fortune 500 companies. A pre-auth RCE in this platform means that any internet-facing, unpatched self-hosted instance is a single HTTP request away from full code execution, no credentials required.
Context: A Week of Critical Exploitation
The ServiceNow exploitation joins an already brutal July patch cycle. Four SharePoint Server CVEs (including CVSS 9.8 CVE-2026-58644) are being chained for RCE, web shell deployment, and IIS machine key theft. Two FortiSandbox OS command injection flaws (CVE-2026-39808 and CVE-2026-25089, both CVSS 9.1) have landed on the CISA KEV with three-day patch deadlines. SonicWall SMA1000 zero-days are being exploited by a likely state-sponsored actor (UTA0533) deploying custom KnuckleBall malware. WordPress core has a chained pre-auth RCE (CVE-2026-63030 + CVE-2026-60137). And Oracle E-Business Suite is being exploited in the wild (CVE-2026-46817, confirmed by the Estée Lauder breach disclosure). Each of these has CISA KEV deadlines that have either just passed or are imminent.
Separately, Hugging Face disclosed the first confirmed breach by an autonomous AI agent. An agentic framework exploited template injection and a remote code dataset loader to gain code execution, steal cloud and cluster credentials, and move laterally across internal systems. Thousands of short-lived sandbox actions with self-migrating C2 on public services. Hugging Face's own forensic analysis was initially blocked by frontier model safety guardrails. This is the "agentic attacker" scenario the industry has been forecasting, and it has now arrived.
So What / Action
If you run self-hosted ServiceNow, patch CVE-2026-6875 immediately. The patch has been available since July 13. Exploitation is active, and the attacker's independent gadget chain means network-level controls tuned to block the published PoC will not stop this. For hosted instances, confirm your version is current.
For the broader July picture: audit every system on the CISA KEV list with a July deadline (SharePoint, FortiSandbox, SonicWall SMA1000, Oracle EBS). The patch deadlines have passed. If you have not applied patches, assume potential compromise and scope incident response accordingly. On SharePoint specifically, patching alone is insufficient; rotate IIS machine keys after patching, or persistence survives remediation.
For AI infrastructure: the Hugging Face breach changes the threat model. Any organization processing untrusted data through AI pipelines (model evaluation, dataset processing, sandboxed inference) should audit those pipelines for code execution paths. Have a self-hosted LLM capability vetted and ready for incident response. Relying on hosted models for forensics introduces a guardrail lockout risk at the moment you can least afford it.