Critical Pre‑Auth RCE in ServiceNow AI Platform (CVE‑2026‑6875) Actively Exploited

Critical Pre‑Auth RCE in ServiceNow AI Platform (CVE‑2026‑6875) Actively Exploited

What It Is – A remote‑code‑execution vulnerability (CVE‑2026‑6875) in the ServiceNow AI Platform allows an unauthenticated attacker to escape the sandbox and run arbitrary code on the ServiceNow instance.

Exploitability – The flaw is being leveraged in the wild; Defused observed exploitation within days of the vendor‑issued patch. No public proof‑of‑concept is required – the attack works against the pre‑auth “/assessment_thanks.do” endpoint.

Affected Products – ServiceNow AI Platform (formerly Now Platform) – both hosted SaaS instances and self‑hosted deployments that have not applied the July 13 2026 security update.

Why It Matters for Compliance & Audit Readiness

• SOC 2 Access Controls – Unauthenticated code execution bypasses logical access boundaries, directly violating the CC6.1 “Logical Access Control” criterion.
• Patch Management Evidence – Continuous proof that critical patches are applied within the vendor‑defined SLA is required to demonstrate due diligence under the CC7.2 “System Operations” criterion.
• Audit Trail Integrity – Exploited RCE can tamper with logs and audit records; maintaining immutable, verifiable logs is essential for a defensible SOC 2 audit.

Recommended Actions

1. Deploy ServiceNow’s July 13 2026 patch to all instances immediately; verify version numbers.
2. Conduct a focused control test mapping CVE‑2026‑6875 to SOC 2 CC6.1 (Logical Access Control) and CC7.2 (System Operations).
3. Capture patch‑deployment evidence (change‑request tickets, SHA‑256 hashes) for audit review.
4. Enable and monitor detailed request‑logging for the /assessment_thanks.do endpoint; alert on anomalous pre‑auth activity.
5. Review and harden sandbox configurations; enforce least‑privilege execution contexts.

Source: BleepingComputer – Critical ServiceNow code execution flaw now exploited in attacks