Thought Leadership
A misconfigured API endpoint allowed unauthorized users to access data stored in ServiceNow instances. The company did not release a fix until several weeks after receiving a bug bounty report.
ServiceNow has confirmed that a configuration error within its platform enabled unauthenticated access to customer data. According to reports from administrators familiar with the issue, a REST endpoint was exposed without requiring user authentication. The company said it became aware of the problem after detecting unusual activity and notified affected customers through its internal support portal as well as direct case notifications.
Security Fix Rolled Out in Early June
On June 5, 2026, ServiceNow deployed a security update across all hosted customer instances. The configuration change ensures that the affected endpoint is now accessible only to authenticated users. According to an internal company bulletin, attackers had successfully exploited the vulnerability prior to the update and executed queries against customer database tables.
ServiceNow did not disclose exactly which data was accessed. However, affected instances commonly contain IT support tickets, employee records, internal documentation, and security-related configuration information.
“On June 5, 2026, ServiceNow applied a security update to hosted customer instances. The update addressed a security vulnerability that, under certain circumstances, could allow an unauthenticated user to gain broader access to ServiceNow instances than intended.”
ServiceNow
More Than Six Weeks Between Report and Patch
A confidential bug bounty submission describing a similar issue was reportedly submitted to ServiceNow on April 22, 2026. Despite the early disclosure, the company did not release a security update until more than six weeks later, after activity targeting customer instances had already been observed.
ServiceNow has not yet provided an explanation for the delayed remediation.
In a subsequent statement, the company said the observed access activity was likely associated with security researchers or bug bounty participants rather than malicious threat actors.
(lb)
