ServiceNow patches exploited authentication bypass flaw
ServiceNow patched an authentication bypass vulnerability on June 5, 2026, after detecting threat actors exploiting it to query customer instance tables without authentication.
ServiceNow disclosed a security incident involving active exploitation of an authentication vulnerability that allowed unauthenticated users to gain unauthorized access to customer instances. The company deployed a security update on June 5, 2026, to address the issue by reconfiguring an endpoint to restrict access to authenticated users only. The flaw affected customers on the Australia platform release or those who made certain configuration changes on earlier releases.
ServiceNow detected anomalous activity and confirmed that threat actors successfully queried instance tables against a subset of customers. All impacted customers have been notified. According to user reports on Reddit, the vulnerability was initially reported to ServiceNow by a customer security team, and the company had been aware of the issue internally since April 7, 2026, but classified it as non-urgent with plans to address it in a future update. The two-month delay between internal awareness and patching allowed threat actors time to identify and exploit the flaw.
The vulnerability remains without a CVE identifier. The incident highlights risks associated with delayed remediation of authentication bypass vulnerabilities in widely deployed enterprise platforms, particularly when threat actors discover and exploit the window between vendor awareness and patch deployment.
Detection guidance
Unauthenticated Access to ServiceNow Table API Endpoint
Detects requests to the ServiceNow Table API (/api/now/table) that lack valid session/authorization context, consistent with exploitation of the authentication bypass allowing unauthenticated table queries. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to ServiceNow Table API Endpoint
logsource:
category: proxy
product: null
detection:
selection:
cs-uri-stem|contains: /api/now/table
filter_authenticated:
cs-uri-query|contains:
- sysparm_ck=
- JSESSIONID
condition: selection and not filter_authenticated
fields:
- c-ip
- cs-uri-stem
- cs-uri-query
- sc-status
- cs-username
falsepositives:
- Legitimate integrations calling the Table API with authorization headers not captured
in the query string field mapped here
- Load balancer or WAF health checks against the same base path
level: medium
tags:
- attack.t1190
- attack.initial-access
id: d6148437-3652-5fa4-803b-a0ffa7f299a3
status: experimental
author: Vorant
High-Volume Anonymous Table Queries Against SaaS Instance API
Detects a pattern of repeated GET requests to a SaaS platform's record/table query API from a single external source without an established authenticated session, indicative of bulk data harvesting after an authentication bypass; investigate as bulk/threshold behaviour when many distinct table names or high request counts are seen from one source within a short window. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: High-Volume Anonymous Table Queries Against SaaS Instance API
logsource:
category: proxy
product: null
detection:
selection:
cs-method: GET
cs-uri-stem|contains: /api/now/table
sc-status: '200'
filter_known_client:
c-useragent|contains:
- ServiceNow-Integration
- MID-Server
condition: selection and not filter_known_client
fields:
- c-ip
- cs-uri-stem
- c-useragent
- sc-bytes
falsepositives:
- Approved integration or MID Server accounts performing legitimate bulk exports whose
user-agent is not captured in the known-client filter
- Scheduled data warehouse ETL jobs pulling large table sets
level: medium
tags:
- attack.t1213
- attack.collection
id: d6363294-23ad-590d-8052-ff42edf11ee0
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thehackernews.com/2026/06/servicenow-flaw-exploited-to-gain.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free