--- title: Critical ServiceNow code execution flaw now exploited in... description: A critical pre-authentication remote code execution vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is now being actively exploited in the wild.... canonical: https://daily.dev/posts/critical-servicenow-code-execution-flaw-now-exploited-in-attacks-nygcyb94u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical ServiceNow code execution flaw now exploited in attacks | daily.dev og:description: A critical pre-authentication remote code execution vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is now being actively exploited in the wild.... og:url: https://daily.dev/posts/critical-servicenow-code-execution-flaw-now-exploited-in-attacks-nygcyb94u og:image: https://api.daily.dev/og/posts/NYGCyb94U.png og:image:alt: Critical ServiceNow code execution flaw now exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical ServiceNow code execution flaw now exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 2 min read · 0 upvotes · 0 comments ## Summary A critical pre-authentication remote code execution vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is now being actively exploited in the wild. Discovered by Searchlight Cyber, the flaw allows unauthenticated attackers to escape the sandbox and execute code remotely in high-complexity attacks. ServiceNow patched hosted instances and released updates for self-hosted deployments on July 13th, but exploitation began just days later. Threat intelligence firm Defused confirmed in-the-wild attacks over the weekend, noting attackers are using a different exploit route than the published proof-of-concept. ServiceNow's official advisory has not yet flagged the vulnerability as actively exploited, though the company urges customers to apply patches immediately. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [ServiceNow discloses security incident exposing customer data](https://daily.dev/posts/servicenow-discloses-security-incident-exposing-customer-data-uu7it8cfu) · BleepingComputer · 2 upvotes · 0 comments - [ServiceNow tells customers a bug left some of their data exposed to the internet](https://daily.dev/posts/servicenow-tells-customers-a-bug-left-some-of-their-data-exposed-to-the-internet-2sypghmj4) · TechCrunch · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/critical-servicenow-code-execution-flaw-now-exploited-in-attacks-nygcyb94u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical ServiceNow code execution flaw now exploited in attacks","url":"https://daily.dev/posts/critical-servicenow-code-execution-flaw-now-exploited-in-attacks-nygcyb94u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-servicenow-code-execution-flaw-now-exploited-in-attacks-nygcyb94u"},"datePublished":"2026-07-20T09:30:34.464Z","dateModified":"2026-07-20T20:27:39.244Z","description":"A critical pre-authentication remote code execution vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is now being actively exploited in the wild....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/edc9b8b39e1ceed0ea507811548dd70b?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/edc9b8b39e1ceed0ea507811548dd70b?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-servicenow-code-execution-flaw-now-exploited-in-attacks-nygcyb94u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Critical ServiceNow code execution flaw now exploited in attacks"}]} ```