ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.
Related Posts:
Critical MongoDB Security Vulnerabilities Require Immediate Patching
CVE-2026-73125: Ebyte NA111-M Flaws Let Attackers Fully Compromise the Device
D-Link DIR-X1860Z Flaw Lets Attackers Change the Admin Password Without Login
The post CVE-2026-18885 (CVSS 10): ServiceNow Code Injection and SQL Injection Flaws Patched appeared first on
Records held in Salesforce and ServiceNow systems are under attack leaving user data exposed, according to researchers at Reco.
The attack appears similar to those perpetrated by the extortion group ShinyHunters, Reco said. ShinyHunters has been particularly active this year, attacking dating sites in January and Oracle in June, and there are fears that they could have found a new target.
Reco has named the latest campaign of attacks “City-Forum,” after a domain name
The attack appears similar to those perpetrated by the extortion group ShinyHunters, Reco said. ShinyHunters has been particularly active this year, attacking dating sites in January and Oracle in June, and there are fears that they could have found a new target.
Reco has named the latest campaign of attacks “City-Forum,” after a domain name associated with the attackers’ IP address. While it bears similarities to Shiny Hunters’ past exploits, there are also differences. This time around the attacker penetrated the systems through the UI-API layer, an attack point that Reco had not seen used before, and had also created its own toolset to carry out the attack. It is also targeting a native ServiceNow Service Portal search endpoint that has almost no online documentation or well-known open-source tools.
The threat is particularly noteworthy, Reco said, as the attackers have studied the services to map different common data-leak vectors, a sign of an advanced approach.
A Salesforce spokesperson said that it was aware of the campaign in which malicious actors are exploiting customers’ overly permissive Experience Cloud guest user configurations in the campaign to potentially access more data than targeted organizations intended.
“This issue highlights risks stemming from misconfigurations, such as overly permissive guest user profiles, and not from a Salesforce vulnerability,” the spokesperson said.
Regardless of who the attackers were and how the attack was carried out, one thing should be clear: Organizations should be increasingly careful about who they give login credentials to.
Attackers are exploiting critical ServiceNow flaw CVE-2026-6875, allowing unauthenticated remote code execution on self-hosted instances.
Searchlight Cyber researchers disclosed a critical pre-authentication remote code execution vulnerability, tracked as CVE-2026-6875, in the ServiceNow AI Platform on July 14. The same day, ServiceNow released patches for self-hosted instances. Since July 17, attackers have started exploiting it in the wild.
“After finding our first pre-auth critical bug
Attackers are exploiting critical ServiceNow flaw CVE-2026-6875, allowing unauthenticated remote code execution on self-hosted instances.
Searchlight Cyber researchers disclosed a critical pre-authentication remote code execution vulnerability, tracked as CVE-2026-6875, in the ServiceNow AI Platform on July 14. The same day, ServiceNow released patches for self-hosted instances. Since July 17, attackers have started exploiting it in the wild.
“After finding our first pre-auth critical bug almost two years ago and having a much better understanding of the ServiceNow architecture, we decided to return and focus our efforts on a different corner of the codebase.” reads the report published by Searchlight Cyber. “Our efforts led to us finding a completely unauthenticated RCE, which allowed full compromise of the ServiceNow instance as well as all connected proxy servers.”
The entry point is ServiceNow’s GlideRecord query API, which accepts user-supplied data in hundreds of places across the codebase. The twist: by prefixing a value with javascript:, ServiceNow evaluates the string as JavaScript before using it as a query argument, a documented feature that turns every unauthenticated query sink into a potential script execution point.
ServiceNow had anticipated this and added a second sandboxing layer for user-supplied filters, called the script sandbox. It restricts function definitions, blocks eval, limits accessible Java classes, and makes table access read-only for unauthenticated users. Getting anything useful out of the initial injection required escaping that additional layer.
“So within the environment of included functions, there are no restrictions applied. However, within our code, they restrict it heavily. Is there any way we can influence the code being run without restrictions? It turns out, we can! Any function that calls a global function can have its calls overridden.” states the report. “But if we include libraries of functions via gs.include(), we don’t get this error at all. We can trace the Java code responsible for the implementation to ASystemInclude.includeScript:”
The sandbox escape uses this gap: by overriding Object.clone with the Function constructor and setting AbstractAjaxProcessor.prototype to the attacker’s payload, a subsequent gs.include('ItemViewElementsProvider') causes the sandbox to call Function(payload) in an unsandboxed context, returning a callable function that executes arbitrary code.
The reachable pre-auth sink is the endpoint /assessment_thanks.do via the parameter sysparm_assessable_type, which passes user input directly into a GlideRecord query with no sanitization.
“The impact is much the same as our previous bug. With our access to the Rhino engine we can pull any data from any tables we like and create admin users at will.” concludes the report. “We can also run shell commands on any proxy servers configured, which commonly sit within companies’ internal network.”
ServiceNow runs more than 100 billion workflows annually and powers AI applications at 85 percent of Fortune 500 companies. The blast radius here is not small.
Searchlight reported the vulnerability on April 1, 2026. ServiceNow deployed mitigations to cloud instances within 24 hours by blocking modification of key JavaScript functions, then followed up with patches addressing the underlying issues over subsequent weeks. The fix is tracked as CVE-2026-6875.
ServiceNow announced it had strengthened its sandbox security by limiting executable code to a single simple expression. The updated Guarded Script blocks variable declarations, control flow, function definitions, assignments, and multiple statements, making sandbox escape attacks much harder.
That structural change makes the same class of sandbox escape significantly harder to pull off in future.
Threat intelligence firm Defused confirmed active exploitation in the wild on Saturday, noting that attackers are hitting the same /assessment_thanks.do sink documented in the Searchlight PoC but reaching code execution via a different gadget chain.
We are observing in-the-wild exploitation of the ServiceNow pre-auth sandbox-escape RCE (CVE-2026-6875)
The payloads hit the same pre-auth sink @SLCyberSec documented (/assessment_thanks.do), but the sandbox-escape gadget reaches the same code-execution primitive by a… pic.twitter.com/E0QZDmer2l
ServiceNow’s official advisory still states it is “not currently aware of exploitation against ServiceNow instances.” Self-hosted customers who haven’t applied the July 13 patches should treat this as urgent, the window between disclosure and weaponization closed in under 72 hours.
Entrar
