Attackers Exploit ServiceNow CVE-2026-6875 via Multiple Sandbox-Escap…

Attackers are exploiting CVE-2026-6875, a critical pre-authentication code-execution flaw in ServiceNow's AI Platform, via multiple sandbox-escape routes. Defused threat intelligence confirms active exploitation using a different gadget chain than the published proof-of-concept, meaning organisations relying on signature-based defences rather than patching remain vulnerable. If you've built anything on top of ServiceNow's AI Platform—workflow automation, custom apps, integrations—you're under active attack right now from unauthenticated actors, and a WAF rule won't stop them. Patching is not optional this week.