2026 ServiceNow — unauthenticated API flaw exploited; customer instance data queried
Data compromised
Customer instance table data queried by attackers; instances commonly hold IT tickets, employee records, internal documentation, asset inventories, security incident reports, and workflow/configuration data
Technical writeup
ServiceNow confirmed a security incident after detecting anomalous activity tied to an unauthenticated access flaw in a REST API endpoint. In a June 5, 2026 customer support bulletin cited by BleepingComputer, the company said it applied a security update to hosted instances that day, restricting the endpoint to authenticated users only, after attackers successfully exploited the issue to query customer instance tables. Community reporting tied the flaw to /api/now/related_list_edit/create with requires_authentication=false; administrators shared IOC requests from IP 51.159.98.241. ServiceNow opened support cases with affected customers and stated customers without a case are not believed impacted. The issue primarily affects Australia platform release customers or older releases with certain configuration changes; no aggregate victim count or CVE was published at initial disclosure.
Root cause
Vulnerable REST API endpoint with authentication disabled (related_list_edit/create; requires_authentication=false)