**Cyberattackers Exploit ServiceNow Flaw, Exposing Unpatched Instances to Hackers**
A critical security flaw in ServiceNow, a platform used by thousands of organizations for workflow automation and IT service management, has been exploited by attackers, putting unpatched instances at significant risk. The vulnerability, tracked as CVE-2026-6875, allows for unauthenticated remote code execution on self-hosted instances.
Searchlight Cyber researchers first disclosed the flaw, which affects all versions of ServiceNow. Unpatched instances can be exploited by hackers, potentially granting them access to sensitive data and internal systems.
**What We Know**
CVE-2026-6875 was reported in February 2026, but attackers have been actively exploiting it since April 2026. ServiceNow has yet to release a patch for the vulnerability, leaving thousands of organizations vulnerable. Searchlight Cyber researchers believe that the vulnerability may have been known to attackers as early as January 2026.
ServiceNow is used by over 20,000 organizations worldwide, with many more likely to be impacted by the vulnerability. While ServiceNow has not released a statement on the number of affected instances, the company’s silence has raised concerns among security experts.
**What This Means**
For organizations running unpatched instances of ServiceNow, the risks are real. Attackers can exploit the vulnerability to gain unauthorized access to sensitive data and internal systems. It’s essential for organizations to take immediate action to address the vulnerability. This may involve patching affected systems, conducting vulnerability scans, and enhancing cybersecurity measures to prevent potential attacks.
The ServiceNow vulnerability highlights the importance of maintaining up-to-date software and patching known vulnerabilities. Organizations must take proactive measures to ensure their security posture and protect against potential threats.
**Action Steps**
Organizations running ServiceNow should:
* Immediately patch affected systems
* Conduct vulnerability scans to identify and remediate other potential vulnerabilities
* Enhance cybersecurity measures, including monitoring and intrusion detection systems
* Review and update incident response plans to address potential attacks
By taking these steps, organizations can minimize the risks associated with the ServiceNow vulnerability and protect sensitive data and internal systems from potential attacks.
