ServiceNow Confirms Vulnerability Allowing Unauthorized Access to Customer Instance Tables

Cybersecuritynews •Abinaya • June 10, 2026

ServiceNow has confirmed a security vulnerability that could allow unauthorized actors to query customer instance tables, raising concerns potential data exposure across enterprise environments. The issue, disclosed through threat intelligence channels, involves improper access controls that may enable attackers to execute queries against backend instance tables without proper authentication. ServiceNow, widely used for IT […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ServiceNow Data Breach Exposes Customer Data via API Vulnerability ServiceNow confirmed a data breach on June 9, 2026, after attackers exploited an unauthenticated API endpoint, allowing access to sensitive customer data. The vulnerability, found in the endpoint '/api/now/related_list_edit/create', was due to a misconfiguration that set the 'requires_authentication' parameter to false. This flaw allowed unauthorized users to query customer instance tables without valid credentials. The breach was detected between June 2 and June 3, 2026, and ServiceNow applied a patch on June 5, 2026, to secure the affected instances. Customers primarily on the Australia platform release or with specific configuration changes were impacted. Evidence suggests that attackers successfully accessed sensitive data, including IT support tickets and employee records. ServiceNow has begun notifying affected customers through support cases, but the full extent of the data accessed remains unclear. This incident marks the third significant authentication-related vulnerability for ServiceNow in eight months. 14 sources 70

Extracted Entities

ServiceNow Confirms Vulnerability Allowing Unauthorized Access to Customer Instance Tables

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)