ServiceNow patches API flaw after unauthorized data access

ServiceNow, a major enterprise software company, has confirmed that attackers exploited a vulnerability in its platform to access data from customer instances. The company deployed a security update on June 5, 2026, to fix the flaw, which involved an API endpoint that lacked proper authentication controls. This allowed unauthenticated users to query data directly from customer instance tables.

The company stated it detected anomalous activity and observed evidence of successful queries against a subset of customers. ServiceNow has begun notifying those affected customers through its support portal and direct support cases. According to the company, customers who have not received a notification should not assume their environment was affected.

The vulnerability primarily impacted customers using the Australia release of the ServiceNow platform. Certain older platform versions may also have been vulnerable if specific configuration changes had been implemented. While ServiceNow has not publicly disclosed the full technical details of the flaw, administrators discussing the incident online have speculated it was related to a REST API endpoint where authentication had been...