Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands An Informa TechTarget Publication Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise Newsletter Sign-Up Newsletter Sign-Up Cybersecurity Topics Related Topics Application Security Cybersecurity Careers Cloud Security Cyber Risk Cyberattacks & Data Breaches Cybersecurity Analytics Cybersecurity Operations Data Privacy Endpoint Security ICS/OT Security Identity & Access Mgmt Security Insider Threats IoT Mobile Security Perimeter Physical Security Remote Workforce Threat Intelligence Vulnerabilities & Threats Recent in Cybersecurity Topics Vulnerabilities & Threats Bug Bounty Research Triggers ServiceNow Security Alert Bug Bounty Research Triggers ServiceNow Security Alert by Alexander Culafi Jun 10, 2026 3 Min Read Vulnerabilities & Threats Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet by Elizabeth Montalbano Jun 10, 2026 5 Min Read World Related Topics DR Global Middle East & Africa Asia Pacific Latin America See All The Edge DR Technology Events Related Topics Upcoming Events Podcasts Webinars SEE ALL Resources Related Topics Resource Library White Papers Reports Webinars Newsletters Podcasts Heard It From a CISO Reporters' Notebook Dark Reading's 20th Videos Dark Reading Polls Partner Perspectives Meet the Editors Advertise With Us About Us Dark Reading Resource Library Vulnerabilities & Threats Application Security Cyberattacks & Data Breaches Identity & Access Management Security News Bug Bounty Research Triggers ServiceNow Security Alert Security research inadvertently led organizations to believe they were being breached through their ServiceNow instances. Alexander Culafi , Senior News Writer , Dark Reading June 10, 2026 3 Min Read Source: JHVEPhoto via Getty Images ServiceNow warned that a vulnerability may have been used to target customer environments, but the company has since attributed this activity to bug bounty research. The business workflow software company yesterday informed customers that, through a gated knowledge base article, the company detected anomalous activity related to a "security issue." The issue, which the company did not explicitly call a vulnerability, could allow greater access than intended. Moreover, an unauthorized user was able to successfully query certain instance tables belonging to a subset of ServiceNow customers. The issue was addressed in a June 5 update, which was applied to hosted customer instances. In the initial knowledge base article, the only technical detail described was that "The security update changes an endpoint configuration to limit access to authenticated users." "The security issue pertains to customers who are on the Australia platform release or made certain configuration changes to instances on releases prior to Australia," the company said. "If you have not received a case from us, then we did not observe such activity in connection with your instance and no action is currently required." Related: Max-Severity Ivanti Flaw Exploited 24 Hours After Disclosure Today, ServiceNow published an additional security notice, which is public facing , that clarifies that, based on the company's investigation, it believes "the observed activity is attributable to security researchers or customer research." "On June 3-4, 2026, customers shared submissions to their bug bounty programs regarding a security issue that could, in certain circumstances, allow an unauthenticated user to gain unwanted access to information in ServiceNow instances," ServiceNow said. "These submissions were similar to a confidential submission sent to our bug bounty program on April 22, 2026." Bug Bounty Researchers Mistaken as Threat Actors ServiceNow said it is in contact with the researchers, who said activity was solely for bug bounty submissions, "and no data was used or retained." "On June 7, 2026, two security researchers submitted a report to our bug bounty program. Based on our investigation to date, we have reason to believe the observed activity can be attributed to security researchers or customers conducting their own research," the notice read. "Our investigation is ongoing, however, and subject to additional validation. Because this research spanned multiple organizations, some of our customers may have received related bug bounty submissions from the same researchers." Related: Nightmare-Eclipse Drops Yet Another Microsoft Exploit, RoguePlanet An integral part of the security ecosystem, independent security research (often observed through bug bounties) covers a broad spectrum of activities. Unfortunately, the nature of independent research can, for one reason or another, cause a researcher to be mistaken as a threat actor. On the opposite end, threat actors can present themselves as researchers or penetration testers at times, and even organizations have presented attackers this way . At present, this may be a case where bug bounty research was mistaken for malicious activity. Ensar Seker, CISO at SOCRadar, says this kind of situation is relatively uncommon, but not unprecedented. "Most bug bounty researchers understand and respect program scope because their reputation, future participation, and potential rewards depend on following the rules," he tells Dark Reading. "However, in large cloud environments, the line between legitimate security research and unauthorized testing can sometimes become blurred, especially when researchers discover a path that unexpectedly leads beyond the intended target or reveals access to production resources." A spokesperson for ServiceNow tells Dark Reading that ServiceNow applied a security update to hosted customers, that the company directly notified affected customers, and that the range of customers impacted "was not broad." Related: Blame AI: Patch Tuesday Hits Record 206 CVEs About the Author Alexander Culafi Senior News Writer, Dark Reading Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Search Security, Nintendo World Report, and elsewhere. At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels. He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today. See more from Alexander Culafi Want more Dark Reading stories in your Google search results? Add Us Now More Insights Industry Reports How Organizations Are Managing Incident Response How Enterprises Are Developing Secure Applications Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy Essential News & Insights from Black Hat USA 2025 How Enterprises Are Harnessing Emerging Technologies in Cybersecurity Access More Research Webinars Advanced Persistent Threats: A Practical Guide to Detection and Response The Frontier AI Era: Why Cybersecurity Must Move at Machine Speed Build vs. Buy: The Hidden Cost of Building Your Own AI Security Stack Defending in the Shadow Era: When the CVE Feed Goes Dark Building SecOps That Make the Most of Every Dollar More Webinars Editor's Choice Cybersecurity Operations 20 Leaders Who Built the CISO Era: 2 Decades of Change 20 Leaders Who Built the CISO Era: 2 Decades of Change by Dark Reading Editorial Team May 12, 2026 41 Min Read Application Security It's Patch Tuesday for Microsoft & Not a Zero-Day In Sight It's Patch Tuesday for Microsoft & Not a Zero-Day In Sight by Jai Vijayan May 12, 2026 5 Min Read Want more Dark Reading stories in your Google search results? Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe Webinars Advanced Persistent Threats: A Practical Guide to Detection and Response Tuesday, June 30, 2026 @ 1:00 PM Eastern Daylight Time The Frontier AI Era: Why Cybersecurity Must Move at Machine Speed Tuesday, June 23, 2026 1:00 PM EDT Build vs. Buy: The Hidden Cost of Building Your Own AI Security Stack Thurs, June 25, 2026, at 1pm EST Defending in the Shadow Era: When the CVE Feed Goes Dark Tues, June 16, 2026 at 1pm EST Building SecOps That Make the Most of Every Dollar Thurs, July 9, 2026 at 1pm EST More Webinars Aug 1-6 | Mandalay Bay, Las Vegas Use code: DARKREADING & save $200 on a Briefings pass or $100 on a Business pass The premier cybersecurity event returns. GET YOUR PASS Anatomy of a Data Breach This comprehensive virtual event examines the main vulnerabilities and exploits that lead to enterprise data breaches, plus the latest tools and best practices for conducting incident response. Beat Hackers To It Discover More Black Hat Omdia Working With Us About Us Advertise Reprints Join Us Newsletter Sign-Up Follow Us Copyright © 2026 TechTarget, Inc. d/b/a Informa TechTarget. This website is owned and operated by Informa TechTarget, part of a global network that informs, influences and connects the world’s technology buyers and sellers. All copyright resides with them. Informa PLC’s registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. TechTarget, Inc.’s registered office is 275 Grove St. Newton, MA 02466. Home | Cookie Policy | Privacy | Terms of Use Your Privacy Choices