ServiceNow AI Platform unauthenticated remote code execution
An unauthenticated attacker can, under certain circumstances, execute code on the ServiceNow AI Platform. Patched by ServiceNow on hosted instances; self-hosted customers and partners must apply the shipped updates.
- Vendor
- ServiceNow
- Product
- ServiceNow AI Platform
- CVSS
- 9.5
- EPSS (exploit probability)
- 1.4%
- Status
- exploited-in-wild
- Published
Is CVE-2026-6875 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-6875 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
CVE-2026-6875 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
NVD tracks CVE-2026-6875 as a remote code execution flaw in the ServiceNow AI Platform, exploitable by an unauthenticated user under conditions ServiceNow does not spell out in the public description. CVSS 4.0 base score 9.5, critical (vector AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H).
ServiceNow addressed the vulnerability by pushing a security update to hosted instances and shipping patches and family releases to self-hosted customers and partners. At disclosure, the vendor’s own advisory stated they were “not currently aware of exploitation against ServiceNow instances.” That posture changed on 2026-07-20 when threat-intelligence firm Defused, via BleepingComputer, reported active exploitation in the wild.
Status flipped here from patched to exploited-in-wild to reflect the Defused report. No CISA KEV entry as of the publish date of the covering article.
Other ServiceNow CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2024-5217 ServiceNow Incomplete List of Disallowed Inputs Vulnerability | [ CRITICAL ] | 9.8 | 99.6% | |
| CVE-2024-4879 ServiceNow Improper Input Validation Vulnerability | [ CRITICAL ] | 9.8 | 100.0% |
