ServiceNow API Breach: Enterprise Customer Data Exposed Before Patch Was
Available
ServiceNow
disclosed on June 9, 2026, that attackers exploited an unauthenticated access
flaw in a Scripted REST API endpoint to query enterprise customer instance data
without valid credentials. This marks the third significant
authentication-related vulnerability at ServiceNow within eight months, and the
first where attackers successfully reached customer data before a patch was
applied.
The
vulnerability allowed unauthorized actors to access sensitive enterprise data
by querying the /api/now/related_edit_list/create endpoint without
authentication. The four-day notification delay between discovery and
disclosure drew criticism from security professionals who rely on timely
notification to protect their organizations.
The incident
highlights a systemic problem identified in the June 2026 cybersecurity
landscape: authentication failures at the API and service layer are the most
consistent root cause of major breaches — not sophisticated zero-day exploits.
Organizations are leaving data exposed simply by failing to enforce the
authentication policies their documentation claims are in place.
ServiceNow
customers are advised to audit all public-facing API endpoints for proper
authentication enforcement, review recent access logs for anomalous queries,
and apply available patches immediately. Security experts recommend continuous
API security testing as a standard practice within enterprise security
programs.
Comments