Service Now Flaw Exploited to Gain Unauthorized Access to Customer Instances
Summary: ServiceNow applied a security update to hosted customer instances on June 5, 2026, addressing a flaw that could let an unauthenticated user gain greater access to instances than intended, and it detected anomalous activity with evidence of successful queries of instance tables against a subset of customers. The company said the issue affects customers on the Australia platform release or those who made certain configuration changes on prior releases, that malicious activity began June 2, 2026, and that bug bounty submissions on June 3-4 resembled a confidential submission received April 22, 2026; a Reddit user named "d3s7iny" claimed ServiceNow had known of the problem internally since April 7, 2026 and treated it as non-urgent for about two months.
Bottom line: A flaw known internally since April 7 was still being exploited on June 2, and the company's own account confirms customer instance tables were successfully queried before the June 5 fix - so the question for your team is what data left those tables in the window.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026