CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platform - Security

CVE-2026-6875 - Sandbox Escape in ServiceNow AI Platform  ServiceNow Posture JULY, 2026 Description ServiceNow has addressed a critical remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability, tracked as CVE-2026-6875, could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform.

Resolution ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners.

Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances.

These patches also include Guarded Script, which is detailed in KB2944435 [Requires a Now Support Login]. Guarded Script features include:

Simple scripts (basic function calls and expressions) will continue to work with no changes. Complex scripts (those using variables, if/else logic, loops, or multiple statements) will need to be moved into a script include. Your instance automatically identifies affected scripts in the Incompatible Guarded Scripts list (once on a version identified in the Rollout Schedule below) — no setup needed. Client-side JavaScript and code inside script includes are not affected. Guest (unauthenticated) traffic is fully enforced immediately on all upgraded instances. On upgraded cloud instances, enforcement for authenticated traffic phases in automatically over approximately four weeks, with automatic exemptions to protect existing functionality. On-premises instances begin detection automatically but require administrators to advance to each enforcement phase manually.

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Release Fixed Version Brazil Brazil EA

Brazil GA

Australia Australia Patch 2 Zurich Zurich Patch 7b

Zurich Patch 9

Yokohama Yokohama Patch 12 Hot Fix 1b

Yokohama Patch 13

Additional Resources KB2930717 – [Requires Now Support Login] April 2026 Security Maintenance – Overview KB KB2930740 – [Requires Now Support Login] Self-Hosted April 2026 Security Maintenance Overview KB2944435 - [Requires Now Support Login] Server-Side Sandbox Runtime Replacement https://www.cve.org/CVERecord?id=CVE-2026-6875

Change Log Version Published Summary of Changes 1.0 July 13, 2026 Initial publication