ServiceNow RCE Exploited Within Days of Public Disclosure
A critical sandbox escape vulnerability (CVE-2026-6875) in ServiceNow's AI platform was actively exploited in the wild just four days after technical details were publicly disclosed by Searchlight Cyber, illustrating the dangerously short window organizations have to patch once exploit details become public. The rapid shift from disclosure to exploitation underscores how threat actors — and potentially security researchers — routinely monitor vulnerability publications to weaponize flaws before defenders can respond. ServiceNow's delayed advisory update further complicated the organizational response, leaving customers uncertain about the true scope of risk. This incident highlights the critical importance of maintaining an aggressive, prioritized patching cadence for internet-facing enterprise platforms, particularly those handling sensitive business workflows. Relying on vendor assurances about hosted instance safety does not eliminate risk for self-hosted or hybrid deployments.
Tactical Insight
Immediate actions
- Apply the ServiceNow-issued patch for CVE-2026-6875 immediately across all self-hosted and hybrid instances.
- Identify and inventory all ServiceNow deployments (hosted, on-premise, hybrid) to confirm patch coverage and exposure scope.
Detection measures
- Deploy IDS/IPS rules and web application firewall signatures targeting sandbox escape exploit patterns for this CVE.
- Continuously monitor ServiceNow application logs for anomalous code execution, unexpected API calls, or privilege escalation attempts.
Long-term improvements
- Establish an emergency patching SLA (e.g., ≤24–48 hours) for Critical CVEs affecting internet-facing enterprise platforms.
- Subscribe to vendor security advisories and threat intelligence feeds to receive real-time alerts when exploitation is confirmed in the wild.
- Implement network segmentation to isolate ServiceNow instances from sensitive internal systems, limiting lateral movement if exploitation occurs.