ServiceNow’s sandbox escape RCE hole now exploited in the wild

ServiceNow patched a sandbox escape RCE vulnerability (CVE-2026-6875, a flaw that lets attackers run unauthorized code on systems they don't control) last week, but attackers are already exploiting it in the wild using modified techniques. Security experts warn this is especially dangerous because the vulnerability affects ServiceNow's sandbox (the security container designed to safely run untrusted code), and a compromise could give attackers access to sensitive data like HR records and potentially spread to corporate networks through integrations.