- Threat intelligence firm Defused confirmed, as reported by Help Net Security, that attackers were exploiting CVE-2026-6875 in the ServiceNow AI Platform as of July 20, 2026. It needs no login.
- ServiceNow is a workflow backbone for many large enterprises, so a pre-authentication remote code execution flaw could expose connected systems and the sensitive data that flows through its AI-enhanced workflows.
- ServiceNow has released patches. Self-managed instances should confirm they are patched, and cloud customers should check with their account team rather than assume, especially if the instance is reachable from the internet.
No Login Needed
CVE-2026-6875 is a pre-authentication remote code execution vulnerability in the ServiceNow AI Platform. Threat intelligence firm Defused confirmed active exploitation in the wild as of July 20, 2026. Pre-authentication means the attacker does not need valid credentials, a session token, or any prior access to the target instance. They need only a network path to an unpatched ServiceNow endpoint.
Why This CVE Matters Beyond IT Ticketing
ServiceNow is not a niche product. It is the workflow automation backbone for a significant share of large enterprises — IT service management, HR operations, security orchestration, and increasingly AI-powered process automation. A pre-auth RCE on this platform does not just compromise one application. It compromises the integration layer that connects dozens of internal systems: identity providers, cloud infrastructure, HR databases, security tooling.
The AI Platform branding adds a dimension that matters in 2026: organizations are routing sensitive data — employee records, customer service transcripts, security alerts — through AI-enhanced workflows built on this infrastructure. An attacker who gains code execution on the platform gains access to whatever data those workflows process.
The Pre-Auth Pattern
Pre-authentication vulnerabilities are a recurring pattern in enterprise platforms because these products are designed to be internet-facing. They serve employee portals, customer self-service, API integrations. Every one of those functions presents an unauthenticated attack surface before a user logs in. When a code execution flaw lands in that surface, the blast radius is not bounded by access controls — there are no access controls to bypass.
This is the same dynamic that made the MOVEit and Citrix pre-auth vulnerabilities of 2023 so damaging. The product's design requires it to accept unauthenticated requests. The vulnerability converts one of those requests into code execution.
What Organizations Should Check
ServiceNow has released patches. Organizations running on-premise or self-managed instances should verify they are on the patched version. Cloud-hosted instances managed by ServiceNow may already be updated, but organizations should confirm with their account team rather than assume. The attack surface is any ServiceNow instance reachable from the internet without a VPN or network-level access control in front of it.
For security teams tracking framework and platform risk, this CVE is a concrete data point in the broader pattern: the enterprise platforms that handle the most sensitive workflow data are also the ones with the largest unauthenticated attack surfaces. The question is not whether your platform vendor will have a pre-auth RCE. The question is whether you will know about it before the attackers do.
Original reporting: helpnetsecurity.com.
