Loading story…
ServiceNow disclosed a security incident after attackers exploited an unauthenticated access flaw in the Scripted REST endpoint /api/now/related_list_edit/create to query data from multiple customer instances. The company said it detected anomalous activity tied to IP address 51.159.98.241, with suspicious access occurring on June 2 and 3, and confirmed successful exploitation. The issue appears to stem from a misconfigured resource with requires_authentication=false, causing requests to be processed as the Guest user; access-control enforcement may also have varied by tenant. Affected environments were reported to include customers on the Australia platform release and some older releases with specific configuration changes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On June 9, ServiceNow disclosed that exploitation of an unauthorized access flaw had enabled successful queries against instance tables for a subset of customers. The company said the issue affected Australia release customers and some pre-Australia instances with certain configuration changes, and that impacted customers were notified directly.
ServiceNow said the anomalous activity tied to the vulnerable API now appears to have come from bug bounty or customer security research rather than malicious attackers. It also disclosed that two researchers submitted a report on June 7 and said no data was used or retained.
On June 5, ServiceNow applied a security update to hosted customer instances and changed the affected API endpoint so it required authentication. The company also opened support cases with affected customers and advised them to review logs and assess possible exposure.
On June 2 and 3, a suspicious foreign IP address, 51.159.98.241, accessed multiple tenants through the vulnerable /api/now/related_list_edit/create endpoint. ServiceNow later confirmed successful exploitation of an unauthenticated access flaw that allowed querying data from customer instances.
ServiceNow said reports describing a flaw that could allow unauthenticated access to information in certain instances were first submitted on April 22. This predates the June bug bounty submissions and indicates the issue had been externally reported earlier.
ServiceNow had internally documented the vulnerability affecting the /api/now/related_list_edit/create Scripted REST endpoint on April 7. The issue was reportedly tied to a misconfigured resource with requires_authentication set to false and was initially treated as non-urgent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
cpomagazine.com
Open sourcecysecurity.news
Open sourcethecyberexpress.com
Open sourcerhisac.org
Open sourcetrust.servicenow.com
Open sourcedarkreading.com
Open sourcethecybersecguru.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ServiceNow released security updates for the Now Platform to fix **CVE-2025-3648**, a high-severity vulnerability with a **CVSS score of 8.2** that researchers at Varonis dubbed **"Count(er) Strike."** The flaw stems from a logical error in **Access Control List (ACL)** rule evaluation, allowing attackers to abuse range query requests to infer or retrieve data they should not be able to access. Both unauthenticated and authenticated attackers could exploit the issue under certain conditions. The vulnerability affects ServiceNow Now Platform versions older than **Xanadu** and **Yokohama** and can expose sensitive information, including credentials, when specific ACL configurations are present. ServiceNow advised customers to upgrade affected instances to **Xanadu** or **Yokohama** and to review mitigation guidance in knowledge base articles `KB2256712` and `KB2046494` to reduce the risk of unauthorized data access.
Jul 24, 2026
Finland’s National Cyber Security Centre warned that an insecure default configuration in the ServiceNow platform can expose sensitive data, and said it has received multiple reports of attacks exploiting the issue. The problem affects portal widgets used to build forms, lists, and tables, particularly the **Simple List** widget, which can be publicly accessible without role restrictions by default. In affected deployments, an unauthenticated attacker may query the widget’s server-side script through the API and retrieve database contents in `JSON` format. The exposed information can include system details, personal data, and confidential business information, depending on how each organization has configured ServiceNow. ServiceNow had also acknowledged that incorrect platform configurations could lead to sensitive information leakage. Authorities urged organizations using the platform to review widget settings and `ACL` configurations, inspect logs for signs of exploitation, and strengthen access controls with measures such as IP-based restrictions, adaptive authentication, and ServiceNow’s **Explicit Roles** add-on.
Jun 29, 2026
ServiceNow patched a **critical unauthenticated remote code execution (RCE)** vulnerability in the *ServiceNow AI Platform* tracked as **CVE-2026-0542**. The flaw can allow an unauthenticated attacker, under certain conditions, to execute code within the **ServiceNow Sandbox**—a restricted environment intended to isolate untrusted code—creating risk of broader instance compromise, including potential data theft and workflow manipulation. Public technical details were limited, but the issue was characterized as remotely reachable (typically over HTTPS) and high impact, with reporting citing **critical severity (CVSS 9.8)**. ServiceNow’s advisory (**KB2693566**) states the company deployed security updates to affected **hosted customer instances** and also made updates available to **self-hosted customers and partners** via patches/hotfixes. As of the advisory information reflected in CVE tracking, ServiceNow reported it was **not aware of active exploitation against customer instances**, but recommended customers apply the relevant updates or upgrade promptly to mitigate the risk from an unauthenticated RCE path into the sandboxed execution environment.
Jun 29, 2026