ServiceNow has disclosed a security incident in which attackers exploited an unauthenticated access vulnerability through a vulnerable API endpoint. The flaw allowed unauthorized queries against customer instances, potentially exposing sensitive data. No CVE identifier has been publicly assigned yet.
The company confirmed active exploitation but has not disclosed the full scope or number of affected customers. The incident is under investigation, with ServiceNow urging clients to review their instance logs for suspicious activity. Details on the attack vector remain sparse, though the vulnerability appears tied to misconfigured or exposed APIs.
Technical specifics are still emerging. The flaw permitted unauthenticated access to data via the endpoint, meaning attackers did not need valid credentials to query customer information. Indicators of compromise may include unusual API traffic patterns or unexpected data extraction attempts.
ServiceNow has released guidance for customers, including steps to restrict API access and review access controls. Patches or configuration updates are being rolled out, though the company has not provided a definitive timeline for all instances. Workarounds involve tightening network security and monitoring for anomalous queries.
Attribution is currently unknown. The incident underscores ongoing risks in enterprise SaaS platforms, where misconfigured APIs can expose vast amounts of customer data even without sophisticated exploits.