Bottom line: Missing API authentication at ServiceNow enabled unauthorized access to customer data.
ServiceNow has reported a security incident in which attackers were able to access customer data via missing authentication on an API endpoint. The incident affected the querying of data from customer instances.
ServiceNow warned its customers of a security incident in which an unauthenticated API endpoint with an access error was exploited. Attackers were thereby able to query data directly from customer instances.
For CISOs, this incident represents an exposure of customer data hosted on ServiceNow platforms. Since ServiceNow is deployed as a central management platform for many enterprises, the risk of broad compromise is significant. The incident demonstrates typical API security failures: missing or insufficient authentication checks at critical endpoints.
CISOs should immediately verify whether their ServiceNow instances are affected and deploy necessary patches. Additionally, a review of access logs and a reassessment of API security in the context of NIS2 requirements for network and information security are recommended.
Source: www.bleepingcomputer.com · Published June 9, 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.6.5.