ServiceNow API Breach: Unauthenticated Endpoint Exposed Data

ServiceNow confirmed on June 5, 2026, that it had applied a security update to address a critical vulnerability in its hosted customer instances after detecting anomalous activity. The flaw involved an unauthenticated access path via a misconfigured API endpoint that allowed attackers to query sensitive data from customer instances without valid credentials.

According to multiple security analyses, the vulnerability had been known internally since at least April 7 but remained unpatched for approximately two months before active exploitation was detected. ServiceNow issued a support bulletin (KB3067321) accessible only via the customer support portal, meaning the broader security community had limited visibility into the issue for several days.

CISA added the vulnerability to its Known Exploited Vulnerabilities catalog (version 2026.06.09), giving federal agencies a remediation deadline. The incident reportedly affected multiple customers, though ServiceNow has not disclosed the full scope of exposed data or the number of affected instances.

The breach highlights a recurring pattern in enterprise SaaS security: APIs that were designed for convenience or internal tooling become attack surfaces when authentication requirements are inconsistent. For organizations running critical IT operations on ServiceNow — which includes many government agencies and Fortune 500 companies — the incident underscores the importance of continuous API security testing and third-party risk assessment.

Key lessons for security teams: verify that all REST API endpoints enforce authentication, implement continuous monitoring for anomalous query patterns, and demand transparency from SaaS vendors about incident timelines. The gap between internal discovery (April) and remediation (June) is the kind of delay that regulatory frameworks are increasingly targeting.