ServiceNow Holds the Map of Your Entire Network. A Pre-Auth Bug Just Handed It to Strangers, and the Patch Is Four Days Old.
- Patrick Duggan
- 2 days ago
- 4 min read
Attackers do not break into ServiceNow for the ticketing. They break in for the map.
A ServiceNow instance holds the CMDB — the configuration management database, which is the single most complete inventory of your infrastructure that exists anywhere in your company. Every server, every application, every dependency, who owns it, what it talks to, what breaks if it goes down. It is the thing a red team spends weeks reconstructing, sitting in one place, indexed and searchable. And this week an unauthenticated attacker got a pre-authentication path to run code on that instance.
What broke
The bug is CVE-2026-6875, a pre-authentication sandbox-escape leading to remote code execution in the ServiceNow AI Platform — the product ServiceNow used to call the Now Platform. Pre-auth means no login, no stolen credential, no phishing step. A crafted request to an exposed instance is the whole attack.
ServiceNow shipped the patch on July 13. By Friday the 17th — four days later — the threat-intelligence outfit Defused reported watching it exploited in the wild, and confirmed sustained activity across the weekend. A public proof-of-concept from Searchlight Cyber was already circulating. That is the compressed timeline that should decide your afternoon: a critical pre-auth RCE in a crown-jewel platform, patch available, exploitation confirmed, and a working exploit in public hands. If you run self-hosted ServiceNow and have not applied the July 13 update, you are inside the window right now.
The detail that will bite the people who "mitigated"
Here is the part worth slowing down for, because it is the difference between patched and merely papered-over. The observed attacks are hitting the instance through the endpoint at /assessment_thanks.do — but the exploitation route the actual attackers are using to reach the code-execution primitive is not the same route the published PoC uses.
That means anyone who reacted to the PoC by blocking its specific path, or writing a WAF rule around the exact request in the public exploit, has stopped the demonstration and not the attack. The sandbox escape has more than one gadget leading to it. This is the recurring lesson of sandbox-escape bugs: the sandbox is a wall with several doors, the PoC walks through one of them to prove the wall is broken, and the wall being broken is the finding — not the particular door. The only thing that actually closes the hole is the vendor patch, because the patch fixes the escape itself rather than one path to it. Signature-blocking the PoC is security theater against an adversary who already found a second way in.
Why "AI Platform" is not just a rename
ServiceNow rebranded the Now Platform to the AI Platform, and it is easy to read that as marketing. But it is also an accurate description of what is now bolted onto the thing: assistants, agents, and automations wired into the same instance that holds the CMDB and the workflow engine that can touch half your other systems. A pre-auth RCE in the platform everyone is racing to make more autonomous is a bigger blast radius than the same bug would have been two years ago, because the platform reaches further now. The more a system can do on your behalf, the more an unauthenticated code-execution bug in it can do on an attacker's.
Where we actually stand on this one
We are not claiming a jump on this. ServiceNow disclosed and patched on July 13, exploitation was reported on the 17th, and we are writing on the 20th — that is us following a live event, not calling it early, and it would be dishonest to frame it otherwise. There is also nothing for us to hand you as a blocklist entry: no command-and-control infrastructure, no scanning source addresses, and no attacker domains have been published for this campaign. The exploitation so far is direct requests to vulnerable instances, which means the indicator that matters is not an IP on a feed, it is whether your own instance is patched. As of this writing CVE-2026-6875 is not yet in the CISA Known Exploited Vulnerabilities catalog; when it lands there, our feed picks it up automatically, but a KEV listing is a formality behind the reality that it is already being exploited.
What we can tell you is what to do, in order.
Apply the July 13 ServiceNow security update to every self-hosted instance now, ahead of anything else on the list, because this is pre-auth and public. If you cannot patch in the next hours, get the instance off the open internet — put it behind a VPN or an allowlist — because the entire attack depends on reaching it, and an instance an anonymous request cannot touch is an instance this bug cannot hit. Then, and this is the part the PoC-blockers will skip, do not settle for a rule around /assessment_thanks.do; verify the patch itself is on, because the attackers are not using the path the exploit demonstrates.
And once you are patched, assume the four-day window was long enough for someone to have looked. Review that instance for unexpected activity since July 13 — new accounts, unfamiliar scheduled jobs, script executions you cannot account for, and above all any bulk read of the CMDB, because if this was exploited against you, the map is what they came for.
We hold this at 95 percent as always — the vulnerability, the timeline, and the in-the-wild reporting are ServiceNow's disclosure and the work of Defused and Searchlight Cyber, corroborated by the trade press, not our own capture. But the operational read is ours and it is simple: patch is the only real fix, the PoC path is a decoy for your defenses, and the prize behind this door is the blueprint of everything you own.
Sources: ServiceNow security advisory for CVE-2026-6875 (July 13, 2026); in-the-wild exploitation reporting by Defused and PoC by Searchlight Cyber, via BleepingComputer and Help Net Security. No network indicators have been published for this campaign; the actionable indicator is your own instance's patch state.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments