ServiceNow Confirms Attackers Queried Customer Instance Tables
Summary
ServiceNow says attackers exploited an unauthenticated API flaw to query customer instance tables. A June 5, 2026 update restricted the endpoint to authenticated users; accessed data has not been disclosed.
Key points
- ServiceNow confirmed attackers exploited an unauthenticated API flaw to query customer instance tables; what data they accessed has not been disclosed.
- The company applied a security update to hosted instances on June 5, 2026, changing the endpoint configuration to require authentication.
- The issue affects some customers on the Australia release and older releases with certain configuration changes.
- ServiceNow opened support cases with affected customers and says customers without a case are not believed to be affected.
- Administrators are advised to review logs for requests to /api/now/related_list_edit, including requests from 51.159.98.241; administrators shared that IP as an indicator.
- ServiceNow has not disclosed technical details or said whether customer data was stolen; it is still evaluating whether to publish a CVE.
Article Details
- Victim Organization
- Not disclosed
- Incident Type
- Attackers exploited an unauthenticated ServiceNow API flaw to query customer instance tables.
- Operational Impact
- ServiceNow confirmed successful queries of customer instance tables. No operational disruption was reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 51[.]159[.]98[.]241 | Administrators shared this IP address as an indicator of compromise for requests to the vulnerable endpoint; the article does not establish who controlled it. |