ServiceNow Unauthenticated REST API Bulk Query via Guest Session (CVE-2026 Scripted REST Exploit)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potential enumeration of ServiceNow API endpoints or unauthorized access attempts from a known malicious IP address. It monitors HTTP header events specifically for common ServiceNow API patterns, aggregating requests to identify high-volume activity or interactions with sensitive endpoints like 'related_list_edit'.