ServiceNow is informing customers that it has patched a vulnerability that appears to have been exploited by attackers.
ServiceNow’s cloud-based platform is widely used by organizations for automating and managing workflows across IT service management, HR, customer service, and other enterprise operations.
The company has not made any information about the cybersecurity incident public, but an advisory available to authenticated customers — a copy of which was shared on Reddit — indicates that hosted customer instances received a security update on June 5.
“The update concerned a security issue that could allow an unauthenticated user, in certain circumstances, to gain greater access to ServiceNow instances than intended,” ServiceNow said. “The security update changes an endpoint configuration to limit access to authenticated users.”
The company added, “We have detected anomalous activity relating to the security issue. For a subset of customers, we have observed evidence of successful queries of instance tables. We have notified customers if successful queries were observed via case.”
ServiceNow clarified in the same advisory that users on its Australia platform release or those who have made specific configuration changes are affected.
Currently, customers are being told that they do not need to take any action. The vendor is evaluating whether to assign a CVE to the vulnerability.
It’s unclear how many customers are affected and who may be behind the exploitation attempts.
SecurityWeek has reached out to ServiceNow for clarification and will update this article if the company responds.
One individual reported on Reddit that their company’s security team informed ServiceNow about the vulnerability last week. The same individual said the vendor appeared to have known about the issue since April 7 but did not view it as a risk.
Related: ServiceNow to Acquire Armis for $7.75 Billion in Cash
Related: No Patch Planned for Exploited Arista EOS Vulnerability
Related: Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks
