Kiran 
A newly disclosed critical, pre-authentication remote code execution vulnerability in the ServiceNow platform, tracked as CVE-2026-6875, lets an unauthenticated attacker fully compromise an instance and any connected proxy servers.
The flaw marks the second time the team has broken ServiceNow’s authentication barrier through unsanitized script execution, following an earlier bug chain that exposed customer data across tenants.
The root cause lies in ServiceNow’s proprietary query builder, GlideRecord, which underpins nearly every table lookup across the Java backend and JavaScript UI layer.
ServiceNow Pre-Auth RCE Flaw
Researchers discovered that ServiceNow’s documented filter operators quietly support a “javascript:” prefix, meaning unauthenticated, user-supplied parameters like sysparm_assessable_type on the assessment_thanks.do endpoint could trigger arbitrary script evaluation instead of a simple string comparison.
This was never intended as a code-execution primitive, but the behavior meant attacker-controlled JavaScript could run before any login screen ever appeared.
ServiceNow anticipated this exact risk and wraps pre-auth filter execution in a second, stricter sandbox layer beyond the platform’s standard scripting restrictions, blocking eval, Function constructors, and function declarations outright.
The researchers found that the gs.include() mechanism, used to load pre-installed script libraries, briefly runs outside these restrictions during the include process itself.
By overriding global helper functions like Object.clone via Object.defineProperty, they tricked ServiceNow’s own class-construction polyfill into invoking the Function constructor on attacker-supplied code, effectively smuggling a payload through a trusted code path.
Once outside the sandbox, an attacker gains access equivalent to full Rhino engine execution: reading arbitrary tables, minting admin accounts, and running shell commands on any configured MID servers sitting inside a victim’s internal network.
Analysis confirms attackers have already begun exploiting CVE-2026-6875 in the wild, describing it as high-complexity but capable of delivering unauthenticated full instance compromise.
Fortified Health Security’s earlier bulletin on a related sandbox-escape flaw in ServiceNow similarly warned of unauthenticated RCE chained with blind SQL injection, underscoring a pattern of pre-auth weaknesses in the platform’s scripting layer.
Mitigation
Searchlight Cyber reported the issue to ServiceNow on April 1, 2026, and the vendor deployed mitigations across cloud instances within 24 hours, followed by underlying patches in the following weeks.
As a longer-term fix, ServiceNow introduced “Guarded Script,” detailed in KB2944435, which restricts sandboxed low-trust scripts to a single simple expression, banning variable declarations, control flow, function declarations, assignment operators, and multiple statements.
Security teams running self-hosted ServiceNow instances should verify patch application and confirm Guarded Script enforcement, since scripts holding a “guarded-script exemption” can still be routed to the older, riskier sandbox evaluator.
About the Author
Potheeswaran 
