FlagThis - Latest Cybersecurity News

In June 2026, a critical broken access control vulnerability was identified in ServiceNow hosted instances, allowing unauthenticated actors to gain unauthorized access to customer environments, likely via API exploitation. The flaw permitted potential data exposure and administrative access. While ServiceNow deployed a security update on June 5, 2026, to mitigate the risk, the incident was complicated by bug bounty researchers whose testing triggered security alerts in several organizations, creating false-positive breach notifications. Organizations should audit API logs for anomalous unauthenticated calls and unauthorized administrative activity to determine if their specific instance was compromised prior to patching.