Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
ServiceNow did experience a real security incident, but the headline “thousands of companies at risk” overstates what is publicly confirmed. In June 2026, a platform bug could allow unauthenticated internet users to access data in some customer instances. ServiceNow deployed a fix to hosted instances on June 5 and later notified affected customers. The company has not publicly disclosed how many organizations were affected or accessed, and the available reporting does not establish that criminals stole data from thousands of companies.
Organizations should nevertheless investigate. The incident may have exposed tickets, employee or customer records, attachments, system details, and—in cases where users stored them improperly—credentials or API keys. A separate July 2026 ServiceNow AI Platform vulnerability, CVE-2026-6875, involved remote code execution and should not be confused with the June data-exposure incident.
At a glance
- What is confirmed: A ServiceNow bug could permit unauthenticated access to some customer-instance data.
- When it was fixed: ServiceNow said it deployed a fix to hosted instances on June 5, 2026.
- Who may have been exposed: Customers on the Australia platform release and some customers on earlier releases with particular configuration changes.
- What is not confirmed: The number of affected companies, the amount of data accessed, and whether criminal attackers retained or misused customer data.
- Separate issue: CVE-2026-6875, disclosed July 13, 2026, was an unauthenticated remote-code-execution vulnerability in the ServiceNow AI Platform.
What happened in June?
ServiceNow notified some enterprise customers that a software bug had made certain customer-instance data reachable by unauthenticated users. In plain language, an internet user may have been able to make requests that should have required authentication and obtain more access to instance data than intended.
ServiceNow applied a platform-side update to hosted instances on June 5. The incident became public through reporting on June 9 and 10. ServiceNow said the activity it observed came from security researchers and customer research teams, rather than malicious actors. It also said researchers told the company their work was connected to bug-bounty submissions and that they did not retain or use customer data. The company did not publicly identify the researchers or state how many customer instances had data accessed. TechCrunch reported ServiceNow’s account and the June 5 remediation.
#1 Best Overall
Independent reporting describes the activity more aggressively. RH-ISAC reported anomalous activity and successful queries against instance tables for a subset of customers, and advised organizations to review logs and custom configurations. Its description does not, by itself, prove that the activity was criminal or that data was exfiltrated.
The most accurate description is therefore: a ServiceNow security incident involving potential unauthorized access to customer-instance data. Calling it a confirmed criminal breach affecting thousands of companies goes beyond the public evidence.
Which ServiceNow customers may be affected?
The strongest available scope statement points to customers using the Australia platform release. Australia is a ServiceNow release name, not a statement that the incident was limited to Australia geographically.
Recommended Free Tools
RH-ISAC also identified certain customers on releases before Australia that had made particular configuration changes. Customizations that altered access controls or endpoint behavior may matter as much as the nominal release family. That means an organization should not assume it was safe solely because it was not on Australia, nor assume it was accessed merely because it was.
Hosted, self-hosted, and partner-managed environments also require different verification steps:
- Hosted customers: ServiceNow may have deployed the platform fix, but customers still need to confirm whether their instance was in the affected population and whether data-access activity occurred.
- Self-hosted or partner-managed customers: Patch timing and responsibility may differ. Confirm the exact build and remediation with the operator.
- Highly customized instances: Review public portals, Scripted REST APIs, ACLs, business rules, integrations, and endpoint overrides against an approved baseline.
There is no verified public count of affected companies. “Thousands” refers to the scale of ServiceNow’s enterprise customer base, not a confirmed number of affected or breached organizations.
What data could have been reachable?
ServiceNow commonly supports workflows across IT, HR, customer service, security, and other business functions. Depending on an organization’s tables, permissions, attachments, integrations, and retention settings, an instance may contain:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- IT support tickets, incidents, and change records;
- HR cases and employee information;
- customer-support records;
- internal infrastructure and operational details;
- security findings and vulnerability information; and
- passwords, API keys, OAuth secrets, tokens, or certificates that users improperly placed in tickets, notes, attachments, or configuration records.
These categories describe what ServiceNow environments can contain; they do not establish that every category was exposed in June. The practical risk depends on which tables were accessible, what ACLs permitted, whether attachments were reachable, and whether sensitive information was stored there at all. TechCrunch also highlighted the possibility of sensitive credentials being present in support data.
Exposure, access, and theft are different findings
Incident teams should separate four concepts:
- Vulnerability: the software or configuration flaw.
- Exposure: data was potentially available to an unauthorized user.
- Observed access: logs or platform telemetry show requests or successful queries.
- Exfiltration or breach: evidence shows data was copied, retained, disclosed, or acquired in a way that meets the applicable legal or organizational definition.
A vulnerable endpoint does not prove that records were viewed. A successful query does not necessarily prove that records were retained. Conversely, the absence of suspicious activity in a customer’s own logs may not prove that nothing happened if relevant logging was disabled, overwritten, or held only by ServiceNow.
ServiceNow’s account versus independent reporting
ServiceNow said the activity was associated with security researchers and customer research teams, and that researchers reported no use or retention of customer data. RH-ISAC described unauthorized access to susceptible instances, anomalous activity, and successful table queries.
Rank #3
These accounts differ in both description and attribution. The public material does not fully reconcile whether every observed request came from authorized research, whether all activity was attributable to the same parties, or how much data was queried. Organizations should record both the vendor’s statement and independent reporting in their incident assessment instead of treating either as conclusive proof of widespread criminal compromise.
Do not confuse the June incident with CVE-2026-6875
On July 13, 2026, ServiceNow disclosed CVE-2026-6875, a separate unauthenticated remote-code-execution or sandbox-escape vulnerability in the ServiceNow AI Platform. This was not the same vulnerability as the June customer-data exposure.
According to the NIST National Vulnerability Database record, affected release ranges included:
- Australia before Australia Patch 2;
- Yokohama before Yokohama Patch 12 Hot Fix 1b and Patch 13;
- Zurich before Zurich Patch 7b and Patch 9; and
- Brazil before Brazil EA and Brazil GA.
NIST’s record, based on ServiceNow’s submission, says ServiceNow was not aware of exploitation against ServiceNow instances. The Canadian Centre for Cyber Security later reported open-source indications of exploitation in the wild and urged administrators to apply updates. Because the statements concern different evidence and potentially different environments, administrators should verify their own patch status rather than infer safety from either statement.
A third issue, CVE-2025-12420, involved ServiceNow AI Platform functionality that could allow an unauthenticated user to impersonate another user and perform operations available to that user. ServiceNow patched hosted instances in October 2025. It is additional security context—not evidence that it caused the June 2026 exposure.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11What potentially affected organizations should do now
1. Confirm release, ownership, and patch status
Record the exact family release, patch level, hosting model, and relevant AI Platform components. Confirm that the June 5 hosted-instance update was applied, and separately check the instance against the CVE-2026-6875 affected-release list. Self-hosted and partner-managed customers should obtain written confirmation from the responsible operator.
2. Ask ServiceNow for instance-specific facts
Contact ServiceNow support or the account team and ask:
- Was the specific instance in the affected population?
- What was the exposure window?
- Which endpoint or configuration caused the exposure?
- Were successful queries observed against the instance?
- Which tables, records, attachments, or tenants were involved?
- What indicators of compromise and platform telemetry are available?
- Are customer-side configuration changes required in addition to the patch?
3. Preserve evidence before changing settings
Export relevant access, transaction, security, and audit logs before modifying configurations. Preserve timestamps, source IPs, request paths, user-agent strings, query patterns, affected table names, ServiceNow notices, and support correspondence. A reported indicator such as 51.159.98.241 may be a useful lead, but it is not proof of compromise or malicious activity and should not be treated as universal evidence.
4. Investigate anonymous and abnormal access
Distinguish expected public-portal traffic from unauthenticated access to records or tables that should not be public. Look for table or metadata enumeration, unusual query volume, unexpected attachments, and requests outside normal business or research activity. Compare findings with authorized bug-bounty, customer-research, and internal-testing activity.
5. Rotate secrets based on exposure risk
If passwords, API keys, integration credentials, OAuth secrets, certificates, or tokens may have appeared in accessible records, revoke and reissue them. Then review downstream authentication logs for unusual IP addresses, regions, devices, times, or API behavior. Prioritize credentials connected to identity systems, cloud platforms, source code, finance, HR, production systems, or privileged administration.
Best Value
6. Assess privacy and legal obligations
Classify the potentially accessible data, identify affected employees, customers, or regulated records, and involve privacy and breach-response counsel. A vendor statement that researchers did not retain or misuse data does not automatically resolve an organization’s own contractual, regulatory, or notification obligations.
7. Review custom configuration and retention
Inventory custom ACLs, public portals, Scripted REST APIs, endpoint overrides, business rules, and integrations. Compare them with approved baselines and investigate changes made near the exposure period. Confirm that a customization did not re-enable unauthenticated access after the vendor fix.
Common mistakes to avoid
- Resetting every password without evidence: first identify whether credentials were stored in potentially accessible records and coordinate resets around actual identity risk.
- Assuming patching proves no access: a fix stops the vulnerability; it does not erase historical activity.
- Treating an IP match as exfiltration: an indicator needs corroboration from requests, query results, telemetry, and downstream evidence.
- Assuming clean logs prove safety: missing retention or incomplete event coverage can leave gaps.
- Publishing sensitive technical details prematurely: coordinate with ServiceNow and incident-response teams before exposing instance names, endpoints, or exploitable details.
- Merging separate vulnerabilities: keep the June data exposure, CVE-2026-6875, and CVE-2025-12420 in separate incident records.
What the “thousands at risk” headline gets wrong
ServiceNow serves a large enterprise customer base, so a vulnerability can have broad potential reach. But potential reach is not confirmed impact. The public record reviewed here does not establish that thousands of companies were breached, that thousands had data stolen, or that every ServiceNow customer was vulnerable.
For decision-makers, the useful question is not “Was every ServiceNow customer hacked?” It is: Was our instance on an affected release or configuration, was it accessed, and did it contain data or credentials that require action? Those answers require tenant-specific confirmation, preserved evidence, and a risk assessment—not a headline alone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
