Breaches and incidentsBriefReported by a reputable outlet, citing the company
ServiceNow: unauthenticated API endpoint exploited to query customer instance tables
ServiceNow notified affected customers of “anomalous activity” in which an unauthenticated access flaw in an API endpoint was used to query data from...
- Disclosed
What happened
- ServiceNow notified affected customers of “anomalous activity” in which an unauthenticated access flaw in an API endpoint was used to query data from customer instance tables; it applied a fix to hosted instances on 5 Jun 2026. Data and customer count not disclosed. Its 10 Jun update says the activity was likely security researchers or customer-led research tied to bug bounty submissions.
- Root cause: an API endpoint reachable without authentication (mainly the Australia release or older releases with certain configuration). Admins on Reddit suspect /api/now/related_list_edit/create with requires_authentication=false (unverified). A similar bug bounty report arrived 22 Apr 2026, six weeks before the fix.
- No threat actor named.
- Endpoint configuration changed to require authentication.
Sources
- https://www.bleepingcomputer.com/news/security/servicenow-discloses-security-incident-exposing-customer-data/
- https://www.cm-alliance.com/cybersecurity-blog/june-2026-biggest-cyber-attacks-data-breaches-ransomware-attacks
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.