What is the CVSS score of CVE-2026-6876?

CVE-2026-6876 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-6876?

Within 24 hours, identify whether your ServiceNow instance is hosted or self-managed, and contact ServiceNow support for patch status specific to your release family (Zurich, Australia, Xanadu, or Yokohama). Within 7 days, implement network-based access controls restricting external connectivity to your Now Platform instance and enable comprehensive logging for suspicious script execution activity. Within 30 days, deploy all available patches from ServiceNow and validate successful remediation.

Now Platform CVE-2026-6876

Q: Which versions of Now Platform are affected by CVE-2026-6876?

ServiceNow Now Platform is vulnerable to unauthenticated remote code execution allowing attackers to escape the platform's scripting sandbox and gain elevated access without credentials.

EUVD-2026-67218 CRITICAL

Code Injection (CWE-94)

2026-08-27 SN

GHSA-7fw9-72q7-3g7j

RCE Code Injection Servicenow Now Platform

10.0

CVSS 4.0 · Vendor: SN

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach internet-facing Now Platform instance
Delivery

Send crafted input to scripting path
Exploit

Escape GlideScript sandbox (CWE-94)
Execution

Execute arbitrary code on platform
Impact

Access/alter instance data beyond intended scope

Vulnerability Assessment

Weakness	CWE CWE-94 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Code injection prevention, sandbox exec MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) indicates no special conditions - remote unauthenticated exploitation against network-reachable Now Platform instances with no user interaction or authentication required, per ServiceNow's own scoring. The practical prerequisite is network reachability to the instance's scripting/evaluation surface. Limiting factors: the target must be an unpatched build (instances on the fixed Zurich/Australia/Xanadu/Yokohama hot fixes are not vulnerable, and ServiceNow-hosted instances were already updated), and while the flaw is a sandbox escape leading to code execution, SSVC currently rates it non-automatable with no observed exploitation, suggesting exploitation may require non-trivial crafting rather than commodity mass-scanning.
Impact	This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with total confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems, and SSVC scores Technical Impact as 'total'. Counterbalancing signals temper the urgency somewhat: EPSS is only 0.32% (25th percentile), the SSVC framework marks Exploitation as 'none' and Automatable as 'no', there is no CISA KEV listing, and ServiceNow reports no known exploitation - so the theoretical severity is maximal but observed real-world exploitation activity is currently absent. Because Now Platform instances are typically internet-exposed SaaS endpoints holding sensitive enterprise workflow data, any organization running a self-hosted or unpatched instance should treat this as urgent and patch immediately despite the low EPSS.
Exploit ScenarioDerived	An attacker sends crafted input to an internet-facing Now Platform instance that reaches a scripting/evaluation path, escaping the GlideScript sandbox to run arbitrary code within the platform without any credentials. From there they could read or tamper with enterprise workflow data (tickets, CMDB, HR records) and pivot deeper into the instance. No public proof-of-concept has been identified at time of analysis.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 01, 2026

Remote code execution in ServiceNow Now Platform allows an unauthenticated attacker to escape the platform's scripting sandbox and execute arbitrary code, gaining more access to the instance than intended. ServiceNow rates this maximum severity (CVSS 4.0 base 10.0) and has patched hosted instances while shipping fixes to self-hosted and partner deployments across the Zurich, Australia, Xanadu, and Yokohama release families. No public exploit identified at time of analysis and ServiceNow states it is not aware of malicious exploitation, though the unauthenticated, network-reachable nature makes prompt patching essential.

Earlier versions of this analysis (1)

v1 Aug 27, 2026 - 20:39 CVSS 8.7

Sandbox escape in ServiceNow's Now Platform enables remote code execution within the platform environment, potentially granting attackers access beyond their intended permission level. Scored 8.7 under CVSS 4.0, the vulnerability is network-accessible with low complexity and high impacts on confidentiality, integrity, and availability of the vulnerable system. ServiceNow has deployed patches to hosted SaaS instances and provided updates to partners and self-hosted customers; no public exploit code and no known malicious exploitation have been identified at time of analysis.

RemediationAI

Apply the ServiceNow-released patch for your instance's release family - the specific fixed builds are Yokohama Patch 13 Hot Fix 4, Xanadu Patch 11 Hot Fix 7a, Australia Patch 5 (or the relevant earlier hot fixes), and Zurich Patch 12 (or the applicable Zurich hot fix) - as documented in ServiceNow KB3152242 (https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242). ServiceNow already deployed the update to hosted instances, so hosted customers should verify their instance is on a patched build; self-hosted and partner-managed customers must apply the update or upgrade promptly since they are not auto-patched. Until patched, compensating controls include restricting network exposure of the instance (limit access to trusted IP ranges/VPN via ServiceNow IP Address Access Control or an upstream WAF) and reviewing custom scripted endpoints and inbound processing for anomalous activity - with the trade-off that IP restrictions can disrupt integrations, mobile users, and partner access, so validate allowlists before enforcing.

Affected VersionsENISA

Now Platform 0 <Yokohama Patch 13 Hot Fix 4

Now Platform 0 <Australia Patch 3m

Now Platform 0 <Australia Patch 3 Hot Fix 2

Now Platform 0 <Xanadu Patch 11 Hot Fix 7a

Now Platform 0 <Zurich Patch 10 Hot Fix 2m (m-branch)

Now Platform 0 <Zurich Patch 10 Hot Fix 3 (standard)

Now Platform 0 <Zurich Patch 9 Hot Fix 6

Now Platform 0 <Zurich Patch 11

Now Platform 0 <Australia Patch 5

Now Platform 0 <Zurich Patch 12

Now Platform 0 <Australia Patch 4

Now Platform 0 <Yokohama Patch 12 Hot Fix 3b

Now Platform 0 <Australia Patch 2 Hot Fix 3

Now Platform 0 <Zurich Patch 7b Hot Fix 3

Now Platform 0 <Zurich Patch 8 Hot Fix 5

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The Now Platform is ServiceNow's low-code application and workflow engine (ITSM, ITOM, HR, custom apps) that executes server-side business logic in a restricted JavaScript-style scripting environment (GlideScript running in a Rhino-based sandbox). This issue is a sandbox escape classified as CWE-94 (Improper Control of Generation of Code / code injection): attacker-controlled input is evaluated as code and breaks out of the intended sandbox restrictions, allowing execution beyond the confined scripting context. The affected CPE is cpe:2.3:a:servicenow:now_platform, spanning multiple named releases per the EUVD data.

Know when Servicenow gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (SN) PRIMARY 10.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vuln.today AI 10.0 CRITICAL

Unauthenticated network RCE via sandbox escape with no user interaction; sandbox-to-platform breakout is a scope change (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (SN).

CVSS VectorVendor: SN

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

High

Subsequent system: Integrity

High

Subsequent system: Availability

High

Lifecycle Timeline

Severity Changed

Sep 01, 2026 - 19:22 NVD

HIGH CRITICAL

CVSS changed

Sep 01, 2026 - 19:22 NVD

8.7 (HIGH) 10.0 (CRITICAL)

CVE Published

Aug 27, 2026 - 18:46 cve.org

HIGH 8.7

DescriptionCVE.org

ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended.

ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.

We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

Executive ViewAI

Why It Matters

ServiceNow Now Platform is vulnerable to unauthenticated remote code execution allowing attackers to escape the platform's scripting sandbox and gain elevated access without credentials. ServiceNow has patched hosted instances but continues deploying fixes to self-hosted and partner environments. Organizations must immediately assess their deployment model and prepare for urgent patching to prevent complete platform compromise.

Business Impact: Severe

Compensating Controls

No vendor-released patch identified for broad self-hosted deployments at time of analysis. Restrict network access to ServiceNow instances from external sources, implement WAF rules to block exploitation attempts against the scripting sandbox, establish detailed logging and alerting for anomalous script execution and privilege escalation attempts, and disable non-essential custom scripting until patches are deployed.

Threat Intelligence Overview

EPSS Score

0.3%

Top 75% exploitable

Prevalence

High

widely deployed enterprise ITSM/workflow SaaS platform across large organizations

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +50

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.