ServiceNow Unauthenticated Guest User Bulk API Data Exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•15

Detects high-volume unauthenticated API queries against a ServiceNow instance by a Guest user. This behavior is indicative of an adversary attempting to exfiltrate sensitive information, such as ticket data, configuration secrets, or employee records, via the 'related_list_edit' REST endpoint or standard table APIs.