Critical ServiceNow code execution flaw now exploited in attacks

Threat intelligence firm **Defused** has identified active exploitation targeting **CVE-2026-6875**, a critical code execution vulnerability in the **ServiceNow AI Platform**, as reported by **BleepingComputer**. Attackers have begun executing malicious code against vulnerable systems to compromise enterprise environments.

The vulnerability targets execution mechanics within the **ServiceNow AI Platform**, enabling unauthorized attackers to achieve arbitrary code execution on host infrastructure. By exploiting flaws in command handling within the AI component, threat actors bypass standard system boundaries and access underlying operational controls.

For systems engineers and security operations teams managing enterprise deployments, active exploitation of **CVE-2026-6875** creates an immediate threat to infrastructure integrity. Because the **ServiceNow AI Platform** connects directly to enterprise databases and internal automation pipelines, arbitrary code execution allows unauthorized access to sensitive operational workflows.

The incident highlights growing security risks across the enterprise software sector as vendors embed automated AI services into core infrastructure. Reports from **Defused** and **BleepingComputer** demonstrate that AI management components are increasingly targeted by threat actors seeking high-privilege access to corporate networks.

Engineering teams running the **ServiceNow AI Platform** should immediately inspect network logs for suspicious activity and potential indicators of compromise tied to **CVE-2026-6875**. Defense teams must apply official vendor patches, restrict external network access to AI platform endpoints, and monitor security advisories for further technical analysis.