TLDR Tech / InfoSec
Smashing the ServiceNow Sandbox – Pre Authentication RCE
Researchers found a pre-authenticated remote code execution path in ServiceNow by abusing GlideRecord query filters that accept JavaScript expressions and run inside a JS sandbox. They showed how to escape this sandbox by manipulating script includes and global objects until attacker-controlled code executes in an unsandboxed Rhino context, allowing data exfiltration, admin account creation, and command execution on connected proxy servers. ServiceNow assigned CVE-2026-6875, rolled out mitigations within 24 hours, blocked modification of key JS functions, and introduced Guarded Script to sharply restrict what pre-auth filter code can do.
Read the full story