ServiceNow Patches Unauthenticated API Endpoint After Data-Exposure Incident

ServiceNow disclosed that a security issue could allow an unauthenticated user, in certain circumstances, to gain greater access to ServiceNow instances than intended - specifically to query data from hosted customer instances without valid credentials. The company detected anomalous activity related to the issue, applied a security update to hosted customer instances on June 5, 2026 that changed the endpoint configuration to require authentication, and published its bulletin, KB3067321, on June 9. Crucially, ServiceNow says that for a subset of customers it observed evidence of successful queries of instance tables, but that its investigation indicates the activity appears attributable to security researchers conducting responsible disclosure - not threat actors - and that it found no evidence customer data was retained or misused.

Independent security analyses attribute the flaw to a Scripted REST Resource endpoint - reported as /api/now/related_list_edit/create - configured with requires_authentication set to false, which allowed unauthenticated HTTP requests to reach and query instance data under certain conditions. The vulnerable state was present in the 'Australia' platform release and in some older releases where specific configuration changes reproduced it. ServiceNow itself has not published the endpoint name or full technical details in a public advisory; these specifics come from third-party analysis and should be treated as such. No CVE has been associated with this hosted-instance configuration issue (it is distinct from earlier, separately tracked ServiceNow vulnerabilities).

ServiceNow indicates the issue primarily affected customers on the 'Australia' platform release - a distribution track, not a geographic restriction, so affected organizations may be located anywhere - along with a secondary group on older releases whose configuration changes reproduced the vulnerable state. ServiceNow observed successful instance-table queries for a subset of customers, not its entire base, and states that no action is required by hosted customers because it remediated the endpoint across hosted instances. This is a materially narrower scope than 'all customers,' and ServiceNow has not published a full list of affected releases or a total count of impacted customers.

ServiceNow remediated the endpoint on June 5 and addressed a variant on June 10, notified impacted customers through support cases, and published KB3067321 - which requires a customer support portal login to view. The company's follow-up statement said the observed activity appears to be security researchers or customer research and that no customer data was retained or misused. That said, the response has drawn criticism: the four-day gap between the silent June 5 patch and the June 9 bulletin, and the login-gated advisory, complicate breach-notification timelines for organizations subject to GDPR, HIPAA, or SEC disclosure rules. A separate, unverified claim circulating in a Reddit post attributed to a self-identified security professional alleges ServiceNow was internally aware of the flaw around April 7, 2026; ServiceNow has not confirmed this and it should be treated with caution.

Even though ServiceNow says no action is required, security-conscious teams can take reasonable precautions. Confirm your instances received the June 5/June 10 updates. Review transaction logs for Guest-user activity against the affected endpoint during the early-June window as the clearest available indicator of exercise of the flaw. Because ServiceNow support tickets frequently contain embedded credentials, API tokens, and secrets, rotating any such credentials that may have been queryable is prudent regardless of attribution. Finally, watch for any updated guidance in KB3067321 (customers can subscribe to it) and reassess whether your organization's regulatory obligations require notification based on your own log review, not solely on the vendor's benign attribution.