{"uuid": "76e771a6-101c-4fa8-a3f1-f41c3fec56db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6875", "type": "seen", "source": "https://t.me/pphm_HackerNews/2177", "content": "\ud83d\udd34 Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026-6875\n\nAttackers are exploiting critical ServiceNow flaw CVE-2026-6875, allowing unauthenticated remote code execution on self-hosted instances.\n\nSearchlight Cyber researchers disclosed a critical pre-authentication remote code execution vulnerability, tracked as CVE-2026-6875, in the ServiceNow AI Platform on July 14. The same day, ServiceNow released patches for self-hosted instances. Since July 17, attackers have started exploiting it in the wild.\n\n\u201cAfter finding our first pre-auth critical bug almost two years ago and having a much better understanding of the ServiceNow architecture, we decided to return and focus our efforts on a different corner of the codebase.\u201d reads the report published by Searchlight Cyber. \u201cOur efforts led to us finding a completely unauthenticated RCE, which allowed full compromise of the ServiceNow instance as well as all connected proxy servers.\u201d", "creation_timestamp": "2026-08-21T23:00:08.154678Z"}