Security vendor Searchlight Cyber went public with a critical pre-authentication remote code execution flaw in ServiceNow’s AI Platform on July 14, the same day ServiceNow shipped patches. Within three days, attackers had weaponized CVE-2026-6875 against unpatched self-hosted instances, according to Searchlight’s threat monitoring.
The root cause sits inside ServiceNow’s GlideRecord query API, a system that processes data from hundreds of user-facing endpoints. A design choice in the platform interprets input strings beginning with javascript: as executable JavaScript before the value reaches the database. ServiceNow added a script sandbox for unauthenticated users that blocks eval(), restricts Java class access, and limits table operations to read-only, but researchers found a sandbox escape path.
The bypass technique overrides the global JavaScript function Object.clone using the Function constructor. When ServiceNow’s library loader executes gs.include(), the overridden constructor runs attacker code in an unrestricted execution context. The pre-authentication entry point is the /assessment_thanks.do endpoint with the parameter sysparm_assessable_type, which passes unfiltered user input directly into a GlideRecord query.
Self-hosted ServiceNow instances should apply the July 14 patch immediately. Since the exploit requires no login credentials, any internet-facing unpatched instance is vulnerable to complete compromise including the ability to pivot into connected proxy servers and internal networks.
