ServiceNow confirmed Tuesday that attackers exploited an unauthenticated API endpoint to query data inside customer instances. The endpoint accepted requests without checking who was asking. That’s the entire story, and it’s not a new story. The same week, researchers disclosed a Microsoft Exchange flaw nicknamed Ghost-Sender that lets attackers spoof any sender address through hybrid mode tenants. Palo Alto Networks is racing active exploitation of CVE-2026-0257 in PAN-OS. Microsoft shipped 204 patches Tuesday, three of them for bugs already public before the fix landed.

Pick a vendor. The cybersecurity failure pattern is the same: a trust boundary that was supposed to enforce identity didn’t. The patch backlog is large, sure. What these incidents share is something defenders cannot patch their way out of. You have to inspect every place your stack assumes a caller is authenticated and verify that assumption actually holds.

ServiceNow’s API Skipped The Auth Check

ServiceNow’s advisory describes an unauthenticated access flaw on a vulnerable API endpoint. Attackers were able to query data from customer instances without supplying credentials. ServiceNow has not yet published full technical detail, but the shape of the issue is familiar to anyone who has reviewed a SaaS code path: an internal-looking endpoint that was supposed to be unreachable from the public internet, or authentication middleware that didn’t apply uniformly to every route, or a developer flag that disabled checks in a corner that nobody re-audited.

ServiceNow is a system of record for IT operations, HR data, CMDB, customer support, and increasingly identity workflows. Customer instances often hold ticket bodies with passwords pasted in, asset inventories with subnet details, configuration export attachments, contractor PII, and approval workflow payloads. If your tenant is in scope, assume the worst-case pull window covers the entire vulnerable period, not just the day of disclosure.

Exchange’s Ghost-Sender Forges Any Address

Dark Reading’s coverage of the Exchange Ghost-Sender flaw is just as ugly. In hybrid mode, Exchange Online or on-premises trusts third-party mail filters and spam appliances as part of the routing chain. The flaw lets an attacker who can place a message into that chain spoof any address inside the tenant. helpdesk@your-company. ceo@your-company. The CFO’s actual address. The recipient sees a fully authenticated, internal-looking message with no SPF or DMARC failure, because the trust is established at a different layer than the one those checks examine.

The pattern matches the ServiceNow flaw. A trust relationship between systems, valid in the abstract, got abused because the validating party assumed the calling party had already done the work. Spam filter trusted Exchange. Exchange trusted the spam filter. Nobody actually authenticated the original sender, but the chain produced a message that looked like everyone had.

The Cybersecurity Gap Sits At The Trust Layer

Microsoft shipped 204 CVE fixes on Tuesday. 38 critical, three publicly disclosed before the patch landed. Palo Alto Networks shipped IOCs for active CVE-2026-0257 exploitation. Patch cadence is a real lever, and you should pull it. The lever that would have stopped these specific incidents sits one layer up.

That lever is an audit of authentication boundaries. Every API endpoint, every mail routing handoff, every appliance management interface, every cloud service that integrates with your SSO. Where does each one assume the caller has already been authenticated? Who validated that assumption last? When was the last time someone tried to bypass it?

Cloudflare’s “customer zero” post this week made the same point from a different angle: architecture matters more than patch speed because architecture decides whether a single unauthenticated path turns into a tenant-wide exposure. ServiceNow’s API became a tenant-wide exposure because the rest of the architecture trusted the API layer to do its own auth. Exchange Ghost-Sender becomes a tenant-wide spoof because routing trust assumed identity had been checked upstream.

What To Do This Week And Every Week After

Treat this as a trust-boundary review, then a patch sprint. Patch what you can. Also do the work the patches don’t address.

• Inventory every API endpoint your tenant exposes on cloud SaaS (ServiceNow, Salesforce, Microsoft 365, Workday). Pull tenant audit logs for unauthenticated or token-less requests in the last 90 days.
• Pull a fresh egress report from your ServiceNow tenant. Look for large query responses, off-hours API calls, and traffic from IPs outside normal admin ranges.
• If you run Exchange hybrid, audit third-party mail filter trust configuration. Validate that SPF and DMARC evaluate the actual message envelope, not the post-relay header your filter inserts.
• Patch PAN-OS for CVE-2026-0257 and check Unit 42’s IOCs against your edge telemetry. Assume the device may already be compromised if it sat unpatched.
• Apply Patch Tuesday with attention to the three pre-disclosed CVEs first. Public disclosure means working PoCs are likely already in adversary hands.
• Tighten brute-force controls on every adjacent authentication surface (VPN, management consoles, SSO sign-in). When one trust boundary breaks, attackers pivot to the next.
• Rehearse the IR playbook for tenant-wide data pull from your SaaS systems. Who calls the vendor? What evidence are you entitled to demand? Where do your backups live?

For ongoing posture, push your defense in depth review past the firewall and into the API and routing layers. Add threat detection on identity events, not only network events. Standardize incident response runbooks so that “unauthenticated access to a SaaS tenant” is a scenario with a named owner. Build security hardening checks into your procurement process, with explicit questions about authentication enforcement on internal APIs and identity-trust chains between integrated systems. Add threat-protection telemetry that watches integration auth events the way you already watch user logins. The cyber security maturity question for 2026 is whether your trust map matches your patch map; for most teams, it doesn’t.

Sources

• ServiceNow discloses security incident exposing customer data
• Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address
• Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
• Microsoft June 2026 Patch Tuesday
• Microsoft Patches 200 Vulnerabilities
• Defend against frontier cyber models: Cloudflare’s architecture as customer zero