Vulnerability class: Pre-authentication remote code execution (Source: NVD entry for CVE-2026-6875; active exploitation confirmed by Defused (reported by Help Net Security, July 20, 2026))
No Login Needed
CVE-2026-6875 is a pre-authentication remote code execution vulnerability in the ServiceNow AI Platform. Threat intelligence firm Defused confirmed active exploitation in the wild as of July 20, 2026. Pre-authentication means the attacker does not need valid credentials, a session token, or any prior access to the target instance. They need only a network path to an unpatched ServiceNow endpoint.
Why This CVE Matters Beyond IT Ticketing
ServiceNow is not a niche product. It is the workflow automation backbone for a significant share of large enterprises — IT service management, HR operations, security orchestration, and increasingly AI-powered process automation. A pre-auth RCE on this platform does not just compromise one application. It compromises the integration layer that connects dozens of internal systems: identity providers, cloud infrastructure, HR databases, security tooling.
The AI Platform branding adds a dimension that matters in 2026: organizations are routing sensitive data — employee records, customer service transcripts, security alerts — through AI-enhanced workflows built on this infrastructure. An attacker who gains code execution on the platform gains access to whatever data those workflows process.
The Pre-Auth Pattern
Pre-authentication vulnerabilities are a recurring pattern in enterprise platforms because these products are designed to be internet-facing. They serve employee portals, customer self-service, API integrations. Every one of those functions presents an unauthenticated attack surface before a user logs in. When a code execution flaw lands in that surface, the blast radius is not bounded by access controls — there are no access controls to bypass.
This is the same dynamic that made the MOVEit and Citrix pre-auth vulnerabilities of 2023 so damaging. The product's design requires it to accept unauthenticated requests. The vulnerability converts one of those requests into code execution.
What Organizations Should Check
ServiceNow has released patches. Organizations running on-premise or self-managed instances should verify they are on the patched version. Cloud-hosted instances managed by ServiceNow may already be updated, but organizations should confirm with their account team rather than assume. The attack surface is any ServiceNow instance reachable from the internet without a VPN or network-level access control in front of it.
For security teams tracking framework and platform risk, this CVE is a concrete data point in the broader pattern: the enterprise platforms that handle the most sensitive workflow data are also the ones with the largest unauthenticated attack surfaces. The question is not whether your platform vendor will have a pre-auth RCE. The question is whether you will know about it before the attackers do.
