ServiceNow Data Breach: Gated Advisory Left Customers Unaware of Exploited Zero-Auth API

Source: Tech Times

Author: unknown

URL: https://www.techtimes.com/articles/318166/20260610/servicenow-data-breach-gated-advisory-left-customers-unaware-exploited-zero-auth-api.htm

ONE SENTENCE SUMMARY:

ServiceNow fixed an unauthenticated API data-query flaw after confirmed exploitation, drawing criticism for delayed, gated disclosure and urgent customer response actions.

MAIN POINTS:

1. Attackers queried sensitive ServiceNow customer tables via an unauthenticated API endpoint.
2. Misconfiguration set requires_authentication=false, bypassing identity and privilege checks entirely.
3. Reported exploited path was /api/now/related_list_edit/create against instance tables.
4. Suspicious requests often came from IP 51.159.98.241, about five per tenant.
5. Confirmed activity occurred June 2–3, 2026; hosted instances patched June 5.
6. ServiceNow published advisory June 9, but hid it behind support-portal authentication.
7. Limited notification meant many customers lacked a trigger to start incident response.
8. Potentially exposed data includes tickets, HR records, assets, incident reports, tokens, and secrets.
9. Credential leakage can enable lateral movement into integrated enterprise systems without further exploits.
10. This is ServiceNow’s third major auth-related issue in eight months; first with pre-patch data access.

TAKEAWAYS:

1. Search transaction logs for /api/now/related_list_edit/create and IP 51.159.98.241 during June 2–5.
2. Review all Scripted REST Resources for requires_authentication disabled, including custom endpoints.
3. Rotate credentials embedded in tickets and integrations immediately, assuming potential exposure.
4. Enable verbose REST/API logging to support future scoping and exfiltration assessment.
5. Engage legal counsel early since “queried vs exfiltrated” affects GDPR, HIPAA, and SEC obligations.