The vulnerability lives in ServiceNow’s GlideRecord query API. When a developer calls addQuery() with a filter value, the platform is supposed to treat that value as data. Searchlight Cyber researcher Adam Kues discovered that supplying a specially crafted javascript: prefix in the query value causes the platform to evaluate the JavaScript expression before using the result as a query argument. That evaluation gives an attacker a scripting handle inside a normally locked-down execution context.

The entry point is a pre-authentication endpoint: /assessment_thanks.do. Anyone who can send an HTTP request to a vulnerable ServiceNow instance can supply the malicious filter parameter without ever logging in. That is what “pre-auth RCE” means in practice — no username, no password, no session cookie, no MFA prompt to bypass. Just the right HTTP request to the right endpoint.

Executing JavaScript inside the sandbox by itself is not the same as compromising the server. Every script in ServiceNow runs subject to sandbox restrictions, whether you are a low-privileged user or an administrator. Searchlight Cyber’s research showed how to chain the initial script-injection with a gadget that escapes the filter sandbox and reaches the general JavaScript execution context — where full server control becomes possible.

Once outside the sandbox, an attacker can query and modify any table, create administrator accounts, and issue commands to connected MID Server proxies. MID Server proxies are the components that let ServiceNow reach into a customer’s internal network for automation tasks — file transfers, credential lookups, ticket enrichment. Compromising the ServiceNow instance therefore compromises everything the instance was permitted to touch.

Here is the detail that changes how defenders should think about this incident. Searchlight Cyber published one working sandbox-escape gadget in its July 14 technical writeup — the demonstration path that made the disclosure concrete. Four days later, Defused observed in-the-wild attacks that reached the same code-execution primitive through a completely different gadget. Same vulnerability, same endpoint, same outcome, different bypass.

Defused CEO Simo Kohonen told CSO Online that his team is seeing far more attack variations for the same vulnerability than a year ago, and attributed it to attackers having better tooling to build their own exploitation chains. In other words, blocking the published PoC is now demonstrably not enough — organizations that added WAF signatures for the Searchlight Cyber gadget and skipped the underlying patch are not protected against what is actually being thrown at them.

Searchlight Cyber reported the flaw on April 1, 2026. Within 24 hours, ServiceNow had deployed mitigations across every cloud-hosted instance, blocking modification of key JavaScript functions used in the sandbox escape. ServiceNow then spent the next roughly ten weeks preparing patches for self-hosted customers and partners, rolling those out throughout June. Public disclosure and the technical writeup landed together on July 13 and 14. Between the initial fix and the disclosure, cloud customers were already protected.

The at-risk population is therefore concentrated in self-hosted ServiceNow AI Platform deployments that had not yet applied the June or July updates when the wild exploits began on July 18. That is a smaller set than the full Fortune 500 footprint, but it still includes highly regulated industries — defense contractors, healthcare organizations, financial institutions — that keep ServiceNow on-premises for compliance or data-residency reasons.

The most awkward part of the current story is not the vulnerability. It is the disconnect between what independent researchers are reporting and what ServiceNow’s own advisory says. As of the most recent updates from BleepingComputer, Help Net Security, and The Hacker News, ServiceNow’s KB3137947 advisory continues to state that the company is “not currently aware of exploitation against ServiceNow instances.” Defused, CSO Online, SecurityWeek, and multiple other reporting organizations have all separately confirmed active exploitation since July 18.

A ServiceNow spokesperson told Help Net Security that the company is “aware of a cybersecurity company’s recent publication regarding exploitation activity” and that based on its investigation to date, the activity is not related to instances that ServiceNow hosts. That is a narrow claim — cloud customers are safe, which was already true because of the April mitigations. It is not a claim that no ServiceNow AI Platform instance is being exploited. Self-hosted customers reading only the official advisory would come away with the wrong risk picture.

ServiceNow does not publish a Fortune-500-only vulnerability count, but the platform’s scale is public. The company reports processing more than 100 billion enterprise workflows a year and powering over 100,000 enterprise AI applications. Coverage of the current disclosure consistently cites the 85% Fortune 500 figure. When a single pre-auth RCE hits a product distributed across that surface, the ceiling on impact is defined less by ServiceNow’s install base and more by how many of those installs are self-hosted and unpatched right now.

The economic angle is worth flagging separately. ServiceNow’s market capitalization sits north of $200 billion. Enterprise SaaS platforms of that size — the same category that includes Salesforce, Workday, and SAP — have become critical infrastructure in the same way that operating systems used to be. A CVE-2026-6875 -class incident on any of them would carry similar consequences, and the SharePoint disclosure last week showed the same dynamic on the Microsoft side. Investors have started pricing this class of risk into large-cap SaaS valuations, but the individual quarterly impact of an incident like this is still hard to model in advance.

Between the SharePoint CVE-2026-58644 zero-day, the ServiceNow AI Platform CVE-2026-6875 exploitation, the WordPress CVE-2026-60137 and CVE-2026-63030 chain, and the SonicWall zero-days used weeks before a patch existed, the July 2026 cybersecurity news cycle has settled on one theme. Time from public disclosure to weaponized attack is now regularly measured in days, sometimes hours. Defenders’ patching SLAs are calibrated to a slower attacker cadence than what is actually happening.

Reporting from Dark Reading on the WordPress incident called it “one of the largest attack surfaces on the Internet” being targeted three days after disclosure. The pattern is the same across every recent enterprise flaw: publish, wait, exploit. That inversion — where the disclosure is functionally the trigger — is what the shift to KEV-based, EPSS-scored triage was built to handle. The question in each specific incident is whether your organization’s patching program can move at the same tempo.

ServiceNow’s fix for CVE-2026-6875 goes beyond patching the specific bypass. The company introduced a new mode called Guarded Script that accepts only a single, simple expression inside sandboxed contexts. Under Guarded Script, the sandbox blocks variable declarations, control flow, function definitions, assignments, and multiple statements. Adam Kues himself acknowledged in Searchlight Cyber’s writeup that this structural change makes future sandbox escapes “significantly harder to pull off.”

That is the right kind of response — narrowing the attack surface at the language level rather than trying to enumerate every possible gadget. But it is also a breaking change that affects customer scripts written to the previous permissive contract. ServiceNow published an “Incompatible Guarded Scripts” list in KB3137947 to help customers audit which of their existing scripts will need to be rewritten to remain compliant after the upgrade.

The bookends matter. CVE-2026-58644 exposed on-premises SharePoint Server to network-based RCE with an actively exploited zero-day. CVE-2026-6875 exposed the ServiceNow AI Platform — the flagship enterprise SaaS platform of the last decade — to the same class of unauthenticated remote takeover. Between them, they cover both sides of the enterprise-collaboration and workflow stack that most large organizations depend on. Neither incident was a supply-chain compromise. Both were direct platform bugs.

Reading the two events together reframes the July 2026 patching cycle. It is not a series of unrelated tickets — it is a compressed demonstration of what the current threat environment looks like when major SaaS and on-prem platforms ship high-severity RCEs in the same window. Any organization that runs both products has to work through both patch paths, both threat-hunting exercises, and both post-compromise assessments simultaneously.