Public PoC released for Critical ServiceNow Sandbox RCE Vulnerability

ServiceNow disclosed and patched a critical pre-authentication sandbox-escape vulnerability (CVE-2026-6875) in its AI platform after Searchlight Cyber published a PoC showing how specially crafted GlideRecord queries and misuse of gs.include() can bypass the restricted script sandbox to achieve remote code execution; successful exploitation could lead to full instance compromise (data access, admin account creation) and interaction with MID Servers. ServiceNow applied cloud-side mitigations, released fixes for affected releases, introduced Guarded Script protections, and reports no known active exploitation.