Enterprise workflow giant ServiceNow quietly warned customers in early June 2026 that attackers exploited an unauthenticated API misconfiguration to query data from hosted instances. BleepingComputer reported the disclosure after ServiceNow applied an emergency security update on June 5, 2026 and opened support cases with affected tenants.
What ServiceNow confirmed
- An API endpoint could allow unauthenticated users, in certain configurations, to gain more access to instances than intended.
- Attackers successfully exploited the flaw to query customer instance tables before the patch.
- The fix changes endpoint configuration so only authenticated users can access it.
- Customers who have not received a ServiceNow support case are not believed affected.
The endpoint admins are talking about
Community discussion on Reddit and admin forums points to /api/now/related_list_edit/create being configured with requires_authentication=false. The June 5 update allegedly flipped that flag to true. Shared indicators of compromise include API traffic from 51.159.98.241.
Why this hurts
ServiceNow instances are not just IT ticketing—they often hold employee records, asset inventories, security incident notes, workflow secrets, and troubleshooting threads where admins paste passwords, API keys, and tokens. Support-case data has become a prime target for credential theft and lateral movement.
Who is most at risk
ServiceNow said the issue primarily impacts customers on the Australia platform release or older releases with certain configuration changes.
Action checklist for admins
- Confirm whether ServiceNow opened a support case for your org—no case likely means no impact per the vendor.
- Review logs for
/api/now/related_list_editrequests, especially from 51.159.98.241. - Audit exposed tickets and records for pasted credentials; rotate anything that appeared in support workflows.
- Enable or verify API access logging until ServiceNow publishes a formal CVE (if any).
Canonical breach record: ServiceNow 2026 API incident on BreachHistory.
Source: BleepingComputer