ServiceNow Unauthenticated Scripted REST Resource Exploitation - related_list_edit

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unauthenticated access attempts to the ServiceNow Scripted REST Resource endpoint '/api/now/related_list_edit/create'. This endpoint has been associated with exploitation activity targeting ServiceNow instances, particularly when accessed by the 'Guest' account or with missing session tokens.