ServiceNow Platform Vulnerability Exploited in Attacks

Attackers have begun actively exploiting a critical vulnerability, identified as CVE-2026-6875, within the ServiceNow AI Platform. This exploitation was reported by the threat intelligence company Defused, which indicated that the flaw allows for unauthenticated remote code execution. The vulnerability resides in the platform's handling of specific API requests, enabling attackers to potentially compromise systems without prior authentication. Defused's analysis suggests that the exploit targets a weakness in how the platform processes certain inputs, leading to arbitrary code execution on the affected servers. The company has not disclosed the exact number of affected organizations or the specific methods used in the ongoing attacks, but emphasizes the severity of the vulnerability. ServiceNow has acknowledged the issue and is reportedly working on a patch to address the CVE-2026-6875 flaw. Organizations utilizing the ServiceNow AI Platform are strongly advised to monitor their systems for any signs of compromise and to apply security updates as soon as they become available. The exploitation of this vulnerability poses a significant risk to businesses relying on ServiceNow for IT service management and workflow automation, as it could lead to data breaches, system disruption, or further network infiltration. The speed at which attackers have moved to exploit this critical flaw underscores the importance of rapid vulnerability management and patching in enterprise environments.