ServiceNow is informing customers that it has patched a vulnerability that appears to have been exploited.
ServiceNow’s cloud-based platform is widely used by organizations for automating and managing workflows across IT service management, HR, customer service, and other enterprise operations.
The company has not made any information about the cybersecurity incident public, but an advisory available to authenticated customers — a copy of which was shared on Reddit — indicates that hosted customer instances received a security update on June 5.
“The update concerned a security issue that could allow an unauthenticated user, in certain circumstances, to gain greater access to ServiceNow instances than intended,” ServiceNow said. “The security update changes an endpoint configuration to limit access to authenticated users.”
The company added, “We have detected anomalous activity relating to the security issue. For a subset of customers, we have observed evidence of successful queries of instance tables. We have notified customers if successful queries were observed via case.”
ServiceNow clarified in the same advisory that users on its Australia platform release or those who have made specific configuration changes are affected.
Currently, customers are being told that they do not need to take any action. The vendor is evaluating whether to assign a CVE to the vulnerability.
It’s unclear how many customers are affected and who may be behind the exploitation attempts.
SecurityWeek has reached out to ServiceNow for clarification and will update this article if the company responds.
One individual reported on Reddit that their company’s security team informed ServiceNow about the vulnerability last week. The same individual said the vendor appeared to have known about the issue since April 7 but did not view it as a risk.
UPDATE: ServiceNow has responded to SecurityWeek’s inquiry, clarifying that it has now published an advisory accessible to everyone.
Importantly, the company pointed out that the exploitation has been attributed to security researchers rather than attackers.
“Based on our investigation to date, we believe the observed activity is attributable to security researchers or customer research,” the company said. “We are in contact with the researchers, and they have advised their activity was solely for bug bounty submissions and no data was used or retained.”
*the first paragraph has been updated to remove the words ‘by attackers’
Related: ServiceNow to Acquire Armis for $7.75 Billion in Cash
Related: No Patch Planned for Exploited Arista EOS Vulnerability
Related: Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks
