ServiceNow Data Exposure via Unauthenticated API Access

In early June 2026, ServiceNow disclosed a security incident involving the exposure of customer data through a vulnerable API endpoint. Attackers were able to perform unauthorized queries against customer instance tables by exploiting a misconfiguration where authentication was not strictly enforced. The issue primarily affected customers on the 'Australia' platform release or those with specific custom configurations on older versions.

Technically, the incident centered on the REST endpoint `/api/now/related_list_edit/create`, which reportedly had the `requires_authentication` parameter set to `false`. This allowed unauthenticated users to enumerate sensitive operational records, including IT tickets, security incident reports, and system configurations. ServiceNow remediated the issue on June 5, 2026, by updating hosted instances to mandate authentication for the affected endpoint.

This incident is significant because ServiceNow instances often contain high-value secrets, such as API tokens, credentials, and internal infrastructure details shared within support workflows. While ServiceNow suggested some activity may be related to bug bounty researchers, they confirmed the detection of "anomalous activity" that necessitated direct customer notifications and support cases.