Loading story…
Bishop Fox disclosed widespread public data exposure risks in ServiceNow environments caused by misconfigured access controls and portal settings rather than a single platform zero-day. In 166 authorized assessments, the firm found that 31% of instances exposed data to unauthenticated users, with positive findings affecting roughly three-quarters of the organizations represented in those cases. The exposures were observed on Service Portal widgets and the Table REST API, where public sessions could sometimes retrieve full backend records or at least confirm record counts without credentials.
Researchers said the stock ticket-attachments widget was a frequent source of exposure, leaking metadata tied to internal business processes and potentially revealing sensitive operational details. To help defenders identify these weaknesses, Bishop Fox released Snowpick, an open-source Go-based scanner that tests public ServiceNow surfaces from an unauthenticated perspective, distinguishes full-record exposure from count-only leaks, and produces bounded evidence for remediation. The findings reinforce that organizations must validate widget behavior, table access, and ACL enforcement independently on any publicly reachable ServiceNow instance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Bishop Fox released Snowpick, an open-source Go tool for testing ServiceNow instances from an unauthenticated perspective for row-level and count-only data exposure. The tool was presented as a way for defenders to identify customer-specific configuration weaknesses rather than a platform zero-day.
Bishop Fox reported that in 166 authorized ServiceNow assessments, 31% of instances had at least one unauthenticated data exposure finding caused by ACL or portal misconfigurations. The exposures were observed via public Service Portal widgets and the Table REST API, with the ticket-attachments widget cited as the most common vector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcebishopfox.com
Open sourceenumerated.ie
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Finland’s National Cyber Security Centre warned that an insecure default configuration in the ServiceNow platform can expose sensitive data, and said it has received multiple reports of attacks exploiting the issue. The problem affects portal widgets used to build forms, lists, and tables, particularly the **Simple List** widget, which can be publicly accessible without role restrictions by default. In affected deployments, an unauthenticated attacker may query the widget’s server-side script through the API and retrieve database contents in `JSON` format. The exposed information can include system details, personal data, and confidential business information, depending on how each organization has configured ServiceNow. ServiceNow had also acknowledged that incorrect platform configurations could lead to sensitive information leakage. Authorities urged organizations using the platform to review widget settings and `ACL` configurations, inspect logs for signs of exploitation, and strengthen access controls with measures such as IP-based restrictions, adaptive authentication, and ServiceNow’s **Explicit Roles** add-on.
Jun 29, 2026
Researchers have identified a stealthy campaign dubbed **City-Forum** that is harvesting data from **Salesforce Experience Cloud** sites and **ServiceNow Service Portals** by abusing overly permissive anonymous guest access rather than exploiting a platform vulnerability. The activity has reportedly been ongoing since at least March 2025 and has targeted organizations in telecommunications, banking and financial services, enterprise software, and the public sector. Investigators said the actor uses a custom multi-platform toolset, including a single Go-based binary, to enumerate Salesforce Aura, Lightning Web Runtime, and ServiceNow environments and exfiltrate information that victims had already exposed to unauthenticated users. The campaign is notable for what researchers described as the first observed in-the-wild exploitation of Salesforce's **UI-API guest surface**, including GraphQL-based queries across versions `v56.0` to `v66.0`, while ServiceNow targeting includes the undocumented `/api/now/sp/search` endpoint to retrieve readable knowledge base and catalog content. Activity was tied to the IP address `158.220.87.79`, associated with `city-forum.com`, with requests reportedly using the `Go-http-client/1.1` user agent from a Contabo-hosted VPS in Germany. Researchers said they found no evidence of a breach in Salesforce or ServiceNow themselves, but warned that misconfigurations such as self-registration and excessive guest permissions could allow broader access and urged defenders to audit public portals, restrict guest capabilities, and review logs for the identified indicators.
Aug 13, 2026
ServiceNow released security updates for the Now Platform to fix **CVE-2025-3648**, a high-severity vulnerability with a **CVSS score of 8.2** that researchers at Varonis dubbed **"Count(er) Strike."** The flaw stems from a logical error in **Access Control List (ACL)** rule evaluation, allowing attackers to abuse range query requests to infer or retrieve data they should not be able to access. Both unauthenticated and authenticated attackers could exploit the issue under certain conditions. The vulnerability affects ServiceNow Now Platform versions older than **Xanadu** and **Yokohama** and can expose sensitive information, including credentials, when specific ACL configurations are present. ServiceNow advised customers to upgrade affected instances to **Xanadu** or **Yokohama** and to review mitigation guidance in knowledge base articles `KB2256712` and `KB2046494` to reduce the risk of unauthorized data access.
Jul 24, 2026