Attackers have begun actively exploiting a critical pre-authentication remote code execution (RCE) vulnerability affecting the ServiceNow AI Platform, just days after patches were released for self-hosted deployments. Originally discovered by Searchlight Cyber, the flaw, tracked as CVE-2026-6875, enables unauthenticated attackers to escape the platform’s sandbox and execute arbitrary code through a high-complexity attack, with exploitation targeting the “/assessment_thanks.do” endpoint using a technique different from the published proof-of-concept. ServiceNow began patching hosted instances in April of 2026 and released updates for self-hosted environments on July 13, but threat intelligence firm Defused confirmed in-the-wild exploitation beginning on July 17. While ServiceNow states it has not observed attacks against its hosted instances and has not officially classified the flaw as actively exploited, it is urging all customers to apply the available security updates immediately. The vulnerability poses significant risk due to the widespread adoption of the ServiceNow AI Platform, which powers more than 100 billion workflows annually and is used by approximately 85% of Fortune 500 companies, making timely patching particularly important for enterprise organizations. CTIX analysts urge any affected administrators to ensure that they are ensuring they are running the most recent patches of ServiceNow to ensure that they are still not vulnerable to exploitation.