DMZ//THREAT INTEL
FEED ACTIVELAST SYNC: 13:15:29ZSOURCES: 14CRITICAL: 18
⚠ ACTIVE ALERTS
@GossiTheDog CRITICAL — wp2shell (CVE-2026-63030 + CVE-2026-60137) is being actively exploited in the wild —… /// @MsftSecIntel CRITICAL — Microsoft is tracking active exploitation of CVE-2026-63030 and CVE-2026-60137… /// @vxunderground CRITICAL — wp2shell PoCs are now floating around the internet. Public exploit code for the full… /// @FalconFeedsio CRITICAL — 🔴 Qilin ransomware group has now publicly claimed 2,035+ victims on its dark web leak… /// @TalosSecurity CRITICAL — Talos is tracking mass exploitation of wp2shell (CVE-2026-63030/CVE-2026-60137).…
18Critical Threats
18Active CVEs
10IOCs Tracked
6New Advisories
INTEL FEED/ARCHIVE/CVE
DMZ INTEL DESK//FILED: 2026-07-21//04:20Z
■ CRITICAL#cve

CVE-2026-6875 Pre-Auth RCE in ServiceNow AI Platform Under Active Exploitation — Second Sandbox-Escape Gadget Chain Confirmed

Attackers began exploiting CVE-2026-6875 (CVSS 9.5), a pre-authentication sandbox-escape RCE in the ServiceNow AI Platform, on July 18 — just five days after self-hosted patches were released on July 13. Threat intelligence firm Defused confirmed a second sandbox-escape gadget chain reaching the same code-execution primitive via a different route than the published PoC, meaning organizations that blocked the known technique rather than patched are still exposed. The platform powers over 100,000 enterprise AI applications at 85% of Fortune 500 companies; unpatched self-hosted instances remain the primary target.

The platform powers over 100,000 enterprise AI applications at 85% of Fortune 500 companies; unpatched self-hosted instances remain the primary target.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.

FILED UNDER:
servicenow · pre-auth-rce · sandbox-escape · cve-2026-6875 · enterprise-saas · active-exploitation
⚿
STAY AHEAD OF THREATS
Daily intel briefs and IOC packages — delivered to your inbox the moment a new advisory drops.
SUBSCRIBE — $29/MO →
SHARE BRIEF:✕ Post on Xin Share on LinkedIn

MORE FROM ARCHIVE

# CVE
2026-07-08
CVE-2026-20896 (CVSS 9.8): Gitea Docker Default Misconfiguration Enables Single-Header Admin Auth Bypass — Active Probing Detected Across ~6,200 Exposed Instances
# CVE
2026-07-06
CVE-2026-45659: Microsoft SharePoint Server Deserialization RCE Confirmed Actively Exploited — CISA KEV Addition; Ransomware Groups Observed Post-Exploitation
# CVE
2026-07-06
CVE-2026-20230: Cisco Unified CM SSRF-to-Root Flaw Confirmed Exploited In-the-Wild — 200+ Internet-Exposed Instances Tracked by Shadowserver
# CVE
2026-06-30
CVE-2026-48558 (CVSS 10) SimpleHelp Auth Bypass Actively Exploited via OIDC; Djinn Stealer Deployed Against MSP Stack