{"uuid": "b8f909b0-b37d-41b0-8c13-047a33b9eca0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-6875", "type": "exploited", "source": "https://t.me/pphm_HackerNews/2177", "content": "\ud83d\udd34 Attackers Exploit Critical ServiceNow RCE Flaw CVE-2026-6875\n\nAttackers are exploiting critical ServiceNow flaw CVE-2026-6875, allowing unauthenticated remote code execution on self-hosted instances.\n\nSearchlight Cyber researchers disclosed a critical pre-authentication remote code execution vulnerability, tracked as CVE-2026-6875, in the ServiceNow AI Platform on July 14. The same day, ServiceNow released patches for self-hosted instances. Since July 17, attackers have started exploiting it in the wild.\n\n\u201cAfter finding our first pre-auth critical bug almost two years ago and having a much better understanding of the ServiceNow architecture, we decided to return and focus our efforts on a different corner of the codebase.\u201d reads the report published by Searchlight Cyber. \u201cOur efforts led to us finding a completely unauthenticated RCE, which allowed full compromise of the ServiceNow instance as well as all connected proxy servers.\u201d", "creation_timestamp": "2026-08-23T00:00:44.911874Z"}