Search/Critical ServiceNow code execution flaw now exploited in attacks
● News

Critical ServiceNow code execution flaw now exploited in attacks

Attackers have begun exploiting a critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform, according to threat intelligence company Defused. Formerly known as the Now Platform, ServiceNow AI Platform is an enterprise-grade Platform-as-a-Service (PaaS) that helps businesses integrate AI into core enterprise workflows. Cybersecurity company Searchlight Cyber, which found this critical vulnerability and reported it on April 1st, says that it allows unauthenticated threat actors to escape the sandbox and execute code remotely within the ServiceNow platform in high-complexity attacks. ServiceNow addressed the flaw across hosted instances starting in April and released CVE-2026-6875 security updates for self-hosted instances one week ago, on July 13th. Over the weekend, Defused…

Read original article
Source
bleepingcomputer.com
Published
Jul 20, 2026
Mentions
3
language: en
Connections
4 relationships