ServiceNow Unauthenticated REST API Data Exfiltration via related_list_edit

Ibrahim Saud@tektrix

•updated Jun 24, 2026•3•0•2

Detects unauthenticated GET requests to the vulnerable ServiceNow REST API endpoint '/api/now/related_list_edit/create' which was exploited in early June 2026. The detection monitors for requests originating from anonymous or guest users, lacking authorization headers, and returning successful (200) responses.