ServiceNow discloses security incident exposing customer data
ServiceNow disclosed a security incident involving an unauthenticated access vulnerability in a REST API endpoint that allowed attackers to query customer instance data. The issue primarily affected customers on the Australia platform release or those with certain configuration changes on older releases. ServiceNow applied a security update on June 5, 2026, to require authentication for the vulnerable API endpoint, mitigating the issue. The exposed data could include sensitive enterprise information such as IT support tickets, employee records, and internal documentation. ServiceNow has notified affected customers via support cases and advises others to review logs for suspicious API requests.
AI Analysis
Technical Summary
Attackers exploited an unauthenticated access flaw in a ServiceNow REST API endpoint ('/api/now/related_list_edit/create') that was configured to allow unauthenticated requests, enabling them to query data from customer instances. The vulnerability was present primarily in customers running the Australia platform release or those with specific configuration changes on older releases. ServiceNow applied a security update on June 5, 2026, changing the endpoint configuration to require authentication, thereby limiting access. The company has notified impacted customers and is evaluating whether to publish a CVE. The exposed data may include sensitive enterprise information commonly stored in ServiceNow instances.
Potential Impact
The vulnerability allowed unauthenticated attackers to query customer instance data, potentially exposing sensitive enterprise information such as IT support tickets, employee records, internal documentation, asset inventories, security incident reports, workflow data, and configuration details. This could lead to unauthorized disclosure of confidential corporate information and credentials contained in support tickets. The incident affected customers on the Australia platform release or with certain configuration changes on older releases. ServiceNow has confirmed exploitation occurred but has not disclosed the full extent of data accessed.
Mitigation Recommendations
ServiceNow applied an official security update on June 5, 2026, to require authentication on the vulnerable API endpoint, effectively mitigating the issue. Customers impacted have been notified via support cases. Administrators are advised to verify that their instances have received this update and to review logs for suspicious API requests to the endpoint '/api/now/related_list_edit/create', especially from the IP address '51.159.98.241'. If a customer has not received a support case from ServiceNow, they are not believed to be affected. No further action is required beyond ensuring the update is applied.
ServiceNow discloses security incident exposing customer data
Description
ServiceNow disclosed a security incident involving an unauthenticated access vulnerability in a REST API endpoint that allowed attackers to query customer instance data. The issue primarily affected customers on the Australia platform release or those with certain configuration changes on older releases. ServiceNow applied a security update on June 5, 2026, to require authentication for the vulnerable API endpoint, mitigating the issue. The exposed data could include sensitive enterprise information such as IT support tickets, employee records, and internal documentation. ServiceNow has notified affected customers via support cases and advises others to review logs for suspicious API requests.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Attackers exploited an unauthenticated access flaw in a ServiceNow REST API endpoint ('/api/now/related_list_edit/create') that was configured to allow unauthenticated requests, enabling them to query data from customer instances. The vulnerability was present primarily in customers running the Australia platform release or those with specific configuration changes on older releases. ServiceNow applied a security update on June 5, 2026, changing the endpoint configuration to require authentication, thereby limiting access. The company has notified impacted customers and is evaluating whether to publish a CVE. The exposed data may include sensitive enterprise information commonly stored in ServiceNow instances.
Potential Impact
The vulnerability allowed unauthenticated attackers to query customer instance data, potentially exposing sensitive enterprise information such as IT support tickets, employee records, internal documentation, asset inventories, security incident reports, workflow data, and configuration details. This could lead to unauthorized disclosure of confidential corporate information and credentials contained in support tickets. The incident affected customers on the Australia platform release or with certain configuration changes on older releases. ServiceNow has confirmed exploitation occurred but has not disclosed the full extent of data accessed.
Mitigation Recommendations
ServiceNow applied an official security update on June 5, 2026, to require authentication on the vulnerable API endpoint, effectively mitigating the issue. Customers impacted have been notified via support cases. Administrators are advised to verify that their instances have received this update and to review logs for suspicious API requests to the endpoint '/api/now/related_list_edit/create', especially from the IP address '51.159.98.241'. If a customer has not received a support case from ServiceNow, they are not believed to be affected. No further action is required beyond ensuring the update is applied.
Technical Details
- Article Source
- {"url":"https://www.bleepingcomputer.com/news/security/servicenow-discloses-security-incident-exposing-customer-data/","fetched":true,"fetchedAt":"2026-06-09T21:40:48.928Z","wordCount":769}
Threat ID: 6a2888608dd33fbd8585eee5
Added to database: 6/9/2026, 9:40:48 PM
Last enriched: 6/9/2026, 9:40:57 PM
Last updated: 6/10/2026, 6:12:31 AM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.