A critical vulnerability in ServiceNow's AI Platform is being actively exploited. CVE-2026-6875 allows attackers to execute code remotely without authentication. ServiceNow issued patches for self-hosted customers in June, but exploitation attempts were first observed on a Friday and confirmed over the weekend.
If you're running a self-hosted ServiceNow instance and haven't patched yet, you're at risk.
What Happened
CVE-2026-6875 is a pre-authentication remote code execution vulnerability in the ServiceNow AI Platform. This flaw lets attackers execute arbitrary code without any authentication. Searchlight Cyber discovered the vulnerability and disclosed it responsibly. Defused, a threat intelligence firm, reported active exploitation attempts.
ServiceNow cloud-hosted instances received automatic patches. Self-hosted instances require manual updates from your team.
Timeline
June 2024: ServiceNow releases patches for self-hosted customers.
Friday (date unspecified): Defused observes first exploitation attempts against vulnerable instances.
Weekend: Exploitation confirmed as active and ongoing.
The gap between patch availability and exploitation represents a critical window where patch management processes either succeed or fail.
Which Controls Failed
Patch Management Process
Organizations that got compromised had patches available for weeks. The failure wasn't in patch availability but in deployment speed.
Your vulnerability management process should have prioritized this. A pre-authentication RCE in a platform that likely touches your CMDB, incident management, and potentially HR data requires immediate patching.
Asset Inventory
If you didn't know you had self-hosted ServiceNow instances, or couldn't identify them quickly, your asset inventory failed. ServiceNow isn't a niche tool. It's infrastructure.
Monitoring and Detection
Post-exploitation detection is your last line of defense. If you're relying on EDR or SIEM to catch an attacker who's already executing code on your ServiceNow instance, you've lost containment of your service management data.
What the Standards Require
PCI DSS v4.0.1 Requirement 6.3.1
"Security vulnerabilities are identified and addressed" with defined processes for risk ranking and patching critical vulnerabilities within defined timeframes.
For a pre-auth RCE in a platform processing cardholder data, you're looking at emergency patching. Your risk ranking should have put this at the top of the queue.
PCI DSS v4.0.1 Requirement 6.3.3
"An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained."
Self-hosted ServiceNow falls into your software inventory. You need version tracking, patch status, and exposure assessment. If you couldn't answer "are we running a vulnerable version?" quickly, your inventory process has gaps.
NIST CSF v2.0 DE.CM-8
"Vulnerability scans are performed" to identify weaknesses that could be exploited.
Your vulnerability scanning should have flagged unpatched ServiceNow instances. If you're only scanning network perimeters and not application layers, you're missing critical exposure points.
ISO/IEC 27001 Control 8.8
"Technical vulnerabilities of information systems are managed" through vulnerability management processes.
This means documented procedures for identifying, evaluating, and treating vulnerabilities. A critical RCE should trigger your highest severity response path, including emergency change processes if needed.
Lessons and Action Items
1. Define Emergency Patch Windows
Create a written policy: pre-auth RCE vulnerabilities in platforms with access to sensitive data get patched within 48 hours, regardless of change freeze windows or approval chains.
Document the approval bypass process. When Defused reports active exploitation on a Friday, you can't wait until Monday's CAB meeting.
2. Inventory Your PaaS Dependencies
List every Platform-as-a-Service tool your organization uses. For each one, document:
- Hosting model (cloud vs. self-hosted)
- Who's responsible for patching
- Data classification of information it processes
- Integration points with other systems
ServiceNow isn't just a ticketing system. It's often your source of truth for asset inventory, change management, and access provisioning. Treat it with the same urgency you'd give your identity provider.
3. Test Your Patch Deployment Speed
Run a tabletop exercise: "Critical RCE announced Friday at 4 PM. Exploitation confirmed Saturday morning. Walk through your actual process."
Time how long it takes to:
- Identify affected instances
- Get emergency change approval
- Deploy patches to dev/test
- Validate functionality
- Deploy to production
- Confirm patch application
If the answer is "more than 72 hours," your process needs work.
4. Segment Your ServiceNow Instance
If you can't patch immediately, reduce blast radius. Network segmentation won't stop a pre-auth RCE, but it limits what an attacker can reach after initial compromise.
Review firewall rules. Does your ServiceNow instance need direct internet access, or can you proxy it? Does it need to reach every VLAN in your environment?
5. Monitor for Indicators of Compromise
Even after patching, check for signs of prior exploitation:
- Unusual administrative account creation
- Unexpected script execution logs
- Anomalous API calls
- Configuration changes outside your change management process
Review ServiceNow audit logs for the period between patch availability and your deployment date.
6. Reassess Your Self-Hosted Posture
This incident highlights the security tradeoffs of self-hosted PaaS. ServiceNow's cloud instances got patched automatically. Self-hosted customers had to manage deployment themselves.
If you're running self-hosted ServiceNow for compliance reasons, document whether those requirements actually mandate self-hosting or just specific controls that could be met through contractual agreements with ServiceNow's cloud offering.
The operational burden of maintaining patch currency on critical infrastructure might outweigh the benefits of self-hosting.
7. Build Vendor Security Into Procurement
When you evaluate PaaS vendors, ask about their vulnerability disclosure and patching process:
- How do they notify customers of critical vulnerabilities?
- What's their SLA for cloud patches vs. self-hosted patch availability?
- Do they provide indicators of compromise?
- What's their track record on pre-auth vulnerabilities?
Make these answers part of your vendor risk assessment, not an afterthought.
CVE-2026-6875 is a reminder that your patch management process is only as good as your ability to execute under pressure. Patches existed for weeks before exploitation started. The organizations that got compromised had time. They didn't have process.
