Executive Summary
ServiceNow has disclosed a high-severity security incident where attackers exploited an unauthenticated access flaw in a Scripted REST Resource to query data from customer instances. The activity, detected between June 2-3, 2026, involved unauthorized queries against a subset of customers, primarily those on the Australia platform release or specific older configurations. ServiceNow applied a remediation to hosted instances on June 5, 2026, by enforcing authentication on the vulnerable endpoint.
The technical root cause was a Scripted REST Resource configured with 'requires_authentication=false', allowing requests to bypass session and credential checks. While ServiceNow has not yet assigned a CVE, the vulnerability has been exploited in the wild, potentially exposing sensitive enterprise data such as IT tickets, employee records, and configuration secrets. Impacted organizations were notified directly via support cases.
This incident highlights the risks of legacy API endpoints and misconfigured authentication settings in SaaS environments. Organizations should verify their notification status, audit custom REST resources, and investigate transaction logs for signs of data exfiltration.