CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platform - Security

CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platform  ServiceNow Posture JULY, 2026 Description ServiceNow has addressed a critical remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.

Resolution ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.

Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Release Fixed Version Brazil Brazil EA

Brazil GA

Australia Australia Patch 2 Zurich Zurich Patch 7b

Zurich Patch 9

Yokohama Yokohama Patch 12 Hot Fix 1b

Yokohama Patch 13

Additional Resources KB2930717 – [Requires Now Support Login] April 2026 Security Maintenance – Overview KB KB2930740 – [Requires Now Support Login] Self-Hosted April 2026 Security Maintenance Overview https://www.cve.org/CVERecord?id=CVE-2026-6875

Change Log Version Published Summary of Changes 1.0 July 13, 2026 Initial publication