VulnerabilityPublished 10 Jun 2026

ServiceNow Patches Vulnerability Exploited Against Some Customers

Source SecurityWeek

Severity

Medium

Rated by Threat Radar

Data as of 11 Jun 2026, 01:06 UTC

What to do

AI-suggested

ServiceNow has applied a security update on June 5, 2026, that changes endpoint configurations to restrict access to authenticated users only. The vendor has notified affected customers directly and currently states that no further action is required by users. Customers should review any communications from ServiceNow and follow guidance provided in official advisories. Patch status is confirmed as fixed by the vendor update.

Description

The company updated hosted customer instances to patch a security issue it reportedly had known about since April 7. The post ServiceNow Patches Vulnerability Exploited Against Some Customers appeared first on SecurityWeek .

Impact

The vulnerability allowed unauthenticated users, under certain conditions, to gain elevated access to ServiceNow instances, potentially exposing sensitive data or enabling unauthorized queries of instance tables. Exploitation was confirmed in a subset of customers, indicating active abuse of the flaw. The impact is limited to those customers on the Australia platform release or with specific configuration changes. No broader impact or data breach details have been publicly disclosed.

Summary

ServiceNow addressed a security vulnerability in its hosted customer instances that could permit unauthenticated users to escalate access beyond intended limits. The vulnerability involved an endpoint configuration that was modified to restrict access to authenticated users only. The company detected anomalous activity consistent with exploitation attempts and confirmed successful queries of instance tables in some cases. The affected customers include those using the Australia platform release or with particular configuration modifications. ServiceNow released the patch on June 5, 2026, and has communicated directly with affected customers. The vendor is evaluating whether to assign a CVE identifier to this vulnerability.

References

securityweek.com/servicenow-patches-vulnerability-exploited-against-some-customers/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 10 Jun 2026, 09:56 UTC

References

Community reviews