CVE-2026-6876 PUBLISHED

Sandbox Escape in ServiceNow AI Platform

Assigner: SN
Reserved: 22.04.2026 Published: 27.08.2026 Updated: 01.09.2026

ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the ServiceNow AI Platform, potentially leading to more access to the ServiceNow AI Platform than intended. 

ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. 

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 10

Product Status

Vendor ServiceNow
Product ServiceNow AI Platform
Versions Default: unaffected
  • affected from 0 to Xanadu Patch 11 Hot Fix 7a (excl.)
  • affected from 0 to Yokohama Patch 12 Hot Fix 3b (excl.)
  • affected from 0 to Yokohama Patch 13 Hot Fix 4 (excl.)
  • affected from 0 to Zurich Patch 7b Hot Fix 3 (excl.)
  • affected from 0 to Zurich Patch 8 Hot Fix 5 (excl.)
  • affected from 0 to Zurich Patch 9 Hot Fix 6 (excl.)
  • affected from 0 to Zurich Patch 10 Hot Fix 2m (m-branch) (excl.)
  • affected from 0 to Zurich Patch 10 Hot Fix 3 (standard) (excl.)
  • affected from 0 to Zurich Patch 11 (excl.)
  • affected from 0 to Zurich Patch 12 (excl.)
  • affected from 0 to Australia Patch 2 Hot Fix 3 (excl.)
  • affected from 0 to Australia Patch 3 Hot Fix 2 (excl.)
  • affected from 0 to Australia Patch 3m (excl.)
  • affected from 0 to Australia Patch 4 (excl.)
  • affected from 0 to Australia Patch 5 (excl.)

Credits

  • Paul Alkemade finder

References