ServiceNow patches exploited authentication bypass flaw
ServiceNow patched an authentication bypass vulnerability on June 5, 2026, after detecting threat actors exploiting it to query customer instance tables without authentication.
Sourcethehackernews.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
ServiceNow disclosed a security incident involving active exploitation of an authentication vulnerability that allowed unauthenticated users to gain unauthorized access to customer instances. The company deployed a security update on June 5, 2026, to address the issue by reconfiguring an endpoint to restrict access to authenticated users only. The flaw affected customers on the Australia platform release or those who made certain configuration changes on earlier releases.
ServiceNow detected anomalous activity and confirmed that threat actors successfully queried instance tables against a subset of customers. All impacted customers have been notified. According to user reports on Reddit, the vulnerability was initially reported to ServiceNow by a customer security team, and the company had been aware of the issue internally since April 7, 2026, but classified it as non-urgent with plans to address it in a future update. The two-month delay between internal awareness and patching allowed threat actors time to identify and exploit the flaw.
The vulnerability remains without a CVE identifier. The incident highlights risks associated with delayed remediation of authentication bypass vulnerabilities in widely deployed enterprise platforms, particularly when threat actors discover and exploit the window between vendor awareness and patch deployment.
Detection guidance
High-Volume Anonymous Table Queries Against SaaS Instance API
A behavioural hunt for the technique in general.
Detects a pattern of repeated GET requests to a SaaS platform's record/table query API from a single external source without an established authenticated session, indicative of bulk data harvesting after an authentication bypass; investigate as bulk/threshold behaviour when many distinct table names or high request counts are seen from one source within a short window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: High-Volume Anonymous Table Queries Against SaaS Instance API
logsource:
category: proxy
product: null
detection:
selection:
cs-method: GET
cs-uri-stem|contains: /api/now/table
sc-status: '200'
filter_known_client:
c-useragent|contains:
- ServiceNow-Integration
- MID-Server
condition: selection and not filter_known_client
fields:
- c-ip
- cs-uri-stem
- c-useragent
- sc-bytes
falsepositives:
- Approved integration or MID Server accounts performing legitimate bulk exports whose
user-agent is not captured in the known-client filter
- Scheduled data warehouse ETL jobs pulling large table sets
level: medium
tags:
- attack.t1213
- attack.collection
id: d6363294-23ad-590d-8052-ff42edf11ee0
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/servicenow-flaw-exploited-to-gain.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs