Attackers are actively exploiting CVE-2026-6875, a critical code execution vulnerability in ServiceNow's AI Platform. Threat intelligence firm Defused confirmed the attacks are underway.
■ Active Attacks Confirmed
Cybersecurity researchers at Defused have identified active exploitation of CVE-2026-6875 in ServiceNow's AI Platform. The vulnerability allows unauthenticated attackers to execute arbitrary code on affected systems.
■ Vulnerability Details
The flaw exists in ServiceNow's AI Platform and carries a critical severity rating. The vulnerability enables remote code execution without requiring authentication, making it particularly dangerous for organizations running vulnerable instances.
■ Immediate Risk
ServiceNow customers using the AI Platform are at immediate risk. The active exploitation indicates threat actors have developed working attack code and are actively targeting systems. Organizations should assume attackers are scanning for and compromising vulnerable deployments.
■ Required Actions
ServiceNow has released patches addressing the vulnerability. Organizations should prioritize applying these updates immediately. Those unable to patch quickly should implement network-level restrictions to limit access to affected ServiceNow instances.
■ Broader Context
This marks another critical vulnerability in enterprise software with active exploitation. ServiceNow platforms are widely deployed across large organizations, making them valuable targets for attackers seeking network access and data theft.
■ Next Steps
Organizations should:
- Audit current ServiceNow deployments for vulnerable versions
- Apply available patches without delay
- Review access logs for signs of exploitation
- Monitor for suspicious AI Platform activity
Defused's disclosure comes as enterprises face increasing pressure from attackers targeting enterprise platforms for initial access into corporate networks.
The FCC is preparing to use its newly granted power to retroactively ban previously approved DJI gadgets imported into the United States. The action targets suspected front companies created to circumvent the foreign drone ban on the Chinese manufacturer.
Flock Safety, a major license plate recognition camera company, has repeatedly provided misleading information to city councils, police departments, and the public, according to an ACLU investigation. The findings raise questions about the accuracy of claims made by the surveillance technology provider.
Prophet Security released a practical framework for assessing AI SOC platforms, helping organizations evaluate solutions based on real-world performance rather than controlled demonstrations.
Hackers are actively exploiting vulnerable WordPress installations to compromise websites, according to multiple cybersecurity firms. WordPress released patches for two critical security flaws last week.