SERVICENOW FLAW UNDER ACTIVE EXPLOITATION

■ Active Attacks Confirmed Cybersecurity researchers at Defused have identified active exploitation of CVE-2026-6875 in ServiceNow's AI Platform. The vulnerability allows unauthenticated attackers to execute arbitrary code on affected systems. ■ Vulnerability Details The flaw exists in ServiceNow's AI Platform and carries a critical severity rating. The vulnerability enables remote code execution without requiring authentication, making it particularly dangerous for organizations running vulnerable instances. ■ Immediate Risk ServiceNow customers using the AI Platform are at immediate risk. The active exploitation indicates threat actors have developed working attack code and are actively targeting systems. Organizations should assume attackers are scanning for and compromising vulnerable deployments. ■ Required Actions ServiceNow has released patches addressing the vulnerability. Organizations should prioritize applying these updates immediately. Those unable to patch quickly should implement network-level restrictions to limit access to affected ServiceNow instances. ■ Broader Context This marks another critical vulnerability in enterprise software with active exploitation. ServiceNow platforms are widely deployed across large organizations, making them valuable targets for attackers seeking network access and data theft. ■ Next Steps Organizations should: - Audit current ServiceNow deployments for vulnerable versions - Apply available patches without delay - Review access logs for signs of exploitation - Monitor for suspicious AI Platform activity Defused's disclosure comes as enterprises face increasing pressure from attackers targeting enterprise platforms for initial access into corporate networks.