ServiceNow Unauthenticated API Data Exfiltration via Guest User on /api/now/ Endpoints

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•11

Detects high-volume, unauthenticated REST API requests to ServiceNow endpoints, specifically those identified as coming from a 'guest' user account or lacking authentication tokens, which may indicate reconnaissance, vulnerability scanning, or automated data extraction attempts.