Critical Pre‑Auth RCE in ServiceNow AI Platform (CVE‑2026‑6875) Enables Remote Code Execution
What It Is — CVE‑2026‑6875 is a pre‑authentication code‑injection flaw in the ServiceNow AI Platform that lets an unauthenticated attacker escape the script sandbox and execute arbitrary code on the instance.
Exploitability — Actively exploited in the wild since mid‑July 2026; researchers observed payloads hitting the /assessment_thanks.do endpoint. The attack requires high‑complexity tooling but provides full compromise of the ServiceNow instance and any connected proxy servers. CVSS ≥ 9.8 (rated Critical by the vendor).
Affected Products — ServiceNow AI Platform (hosted SaaS and self‑hosted deployments).
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC7.1 – System Operations demands evidence that critical platform components are patched promptly; a pre‑auth RCE bypasses traditional access controls and can invalidate that evidence.
- Continuous control monitoring must capture patch‑status and sandbox‑hardening metrics (e.g., Guarded Script) to demonstrate due diligence to auditors and enterprise buyers.
- Failure to remediate exposes organizations to “control gap” findings during SOC 2 examinations, potentially delaying certification or triggering adverse audit opinions.
Recommended Actions
- Apply the July 13 2026 ServiceNow security update immediately on all self‑hosted instances; verify the Guarded Script feature is enabled.
- Map the vulnerability to SOC 2 CC7.1 and CC6.1 controls in your control‑mapping repository; capture patch‑deployment logs as immutable audit evidence.
- Enable continuous monitoring of the
/assessment_thanks.doendpoint and related script‑execution logs for anomalous activity. - Conduct a post‑patch validation scan and update your incident‑response playbook to include pre‑auth RCE scenarios.
Source: Help Net Security – ServiceNow pre‑auth RCE exploited in the wild (CVE‑2026‑6875)