NewsPublished 9 Jun 2026

ServiceNow discloses security incident exposing customer data

Source Bleeping Computer

Description

ServiceNow is warning about a security incident after attackers exploited an unauthenticated access flaw through a vulnerable API endpoint, allowing them to query data from customer instances. [...]

Impact

The vulnerability allowed unauthenticated attackers to query customer instance data, potentially exposing sensitive enterprise information such as IT support tickets, employee records, internal documentation, asset inventories, security incident reports, workflow data, and configuration details. This could lead to unauthorized disclosure of confidential corporate information and credentials contained in support tickets. The incident affected customers on the Australia platform release or with certain configuration changes on older releases. ServiceNow has confirmed exploitation occurred but has not disclosed the full extent of data accessed.

Defensive guidance

ServiceNow applied an official security update on June 5, 2026, to require authentication on the vulnerable API endpoint, effectively mitigating the issue. Customers impacted have been notified via support cases. Administrators are advised to verify that their instances have received this update and to review logs for suspicious API requests to the endpoint '/api/now/related_list_edit/create', especially from the IP address '51.159.98.241'. If a customer has not received a support case from ServiceNow, they are not believed to be affected. No further action is required beyond ensuring the update is applied.

References

bleepingcomputer.com/news/security/servicenow-discloses-security-incident-exposing-customer-data/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 9 Jun 2026, 21:40 UTC

References

Community reviews