ServiceNow discloses security incident exposing customer data
ServiceNow says attackers used an unauthenticated API flaw to query customer instance data before a June 5 fix. It is notifying affected customers and weighing a CVE.
Intelligence analysis by GPT-5.4 Mini
ServiceNow disclosed a security incident after attackers exploited an unauthenticated access flaw in a vulnerable API endpoint. The company says it patched hosted instances on June 5 and is now warning impacted customers whose instances may have been queried.
ServiceNow found a locked door in one of its systems that was letting the wrong people peek inside. It fixed the door and is now telling customers to check whether anyone looked at their files, like a company checking who got into a file cabinet.
Analysis
What happened
ServiceNow says it found anomalous activity tied to a security issue that let an unauthenticated user, in some circumstances, gain more access than intended. The company says it pushed a security update to hosted customer instances on June 5, 2026, and that the update changed the API endpoint configuration so only authenticated users can access it.
According to the article, ServiceNow has confirmed that attackers exploited the flaw and successfully queried tables in customer instances. The company did not say what specific data was accessed, but customer instances can hold sensitive material such as IT support tickets, employee records, internal documents, asset inventories, incident reports, workflow data, and system configuration details.
Who is affected
ServiceNow told customers through support bulletins and direct support cases, but the bulletin is hidden behind its support login portal. The company says customers who did not receive a support case are not believed to be affected.
The bulletin says the issue mainly affects customers on the Australia platform release, or customers on older releases who made certain configuration changes before that release.
Clues from administrators
The article says administrators discussing the incident on Reddit believe the problem is tied to the REST endpoint /api/now/related_list_edit/create. One commenter claimed that endpoint had requires_authentication=false, and that the Friday update changed it to true. Admins also shared possible indicators of compromise, including requests from IP address 51.159.98.241.
What ServiceNow is advising
ServiceNow is still evaluating whether to publish a CVE. In the meantime, administrators are told to review logs for requests to /api/now/related_list_edit, check for activity from the listed IP, review exposed tickets and records for sensitive information, rotate any credentials or tokens shared through support workflows, and make sure API logging is enabled.
Key points
- ServiceNow says attackers exploited an unauthenticated API flaw to query data from customer instances.
- The company applied a security update on June 5, 2026, and says the fix limits access to authenticated users.
- ServiceNow has not disclosed what data was accessed, but customer instances can contain sensitive enterprise records.
- The issue appears to affect Australia release customers and some older releases with certain configuration changes.
- Administrators are being told to review logs, investigate requests to the vulnerable endpoint, and rotate exposed credentials or tokens.
If the patch and customer notifications work as intended, affected organizations can quickly check logs, limit exposure, and rotate anything sensitive that may have been shared through support workflows. ServiceNow’s review may also lead to a CVE, which would give defenders a clearer public handle on the issue.
If attackers had time to query meaningful tables, organizations may need to treat the incident as a data-exposure event even without a public list of stolen records. The lack of disclosed technical detail also leaves some customers dependent on support cases and log review to know whether they were hit.
