Reported by 1 outlet
CVE-2026-6875 — ServiceNow AI Sandbox Escape Exploited Days After Disclosure
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.40 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
CVE-2026-6875 — ServiceNow AI Sandbox Escape Exploited Days After Disclosure
securityweek.com · 85d ago · July 21st, 2026
A critical sandbox escape vulnerability in ServiceNow's AI platform (CVE-2026-6875) is under active exploitation just four days after patches were released. The flaw allows unauthenticated attackers to execute arbitrary code by escaping the AI sandbox in certain configurations. ServiceNow deployed fixes to hosted instances on July 14; Searchlight Cyber disclosed technical details and PoC the same day. Threat intelligence firm Defused reported in-the-wild exploitation on July 18, with the captured payload later confirmed identical to Searchlight's PoC.
ServiceNow has not updated its advisory to reflect active exploitation, stating it has "not observed evidence that this activity is related to instances that ServiceNow hosts" — but self-hosted customers must patch immediately. Given the tight window between disclosure and weaponization, treat this as an exploitation race.
Action: Self-hosted ServiceNow customers: apply patches immediately. Hosted instances were auto-patched, but verify. Monitor for exploitation artifacts matching Searchlight Cyber's published PoC patterns.
Sources: