ServiceNow's Unpatched API Endpoint Sparks 6% Selloff; Analysts Eye 42% Recovery as Macro Clouds Gather

ServiceNow shares fell 6.2% after an unauthenticated API endpoint exposed customer data, amplifying selloff from bond market headwinds and insider selling, despite 22% subscription growth and analyst optimism.

ServiceNow’s stock suffered its worst single-day drop in months on Tuesday after the company disclosed a security vulnerability in one of its API endpoints. Attackers exploited an unauthenticated interface to access customer data, triggering a 6.2% intraday decline that left the shares at €91.82 by Wednesday, down about 8.85% on the week.

The flaw lay in the endpoint /api/now/related_list_edit/create, which had been inadvertently configured with requires_authentication = false. ServiceNow patched the hole on June 5 and issued an official warning on June 9, but the market’s reaction came after a formal disclosure on Tuesday. Investigators traced the activity to a single IP address, though the company said there was no evidence of widespread data theft. The vulnerability primarily affected customers running the “Australia” platform version or certain legacy configurations.

The security incident struck at a time when growth stocks were already under pressure from the bond market. The yield on the 10-year US Treasury climbed to 4.55% on the back of a stronger-than-expected May jobs report, which showed 172,000 new positions added. That data reinforced expectations that the Federal Reserve will hold off on rate cuts, a headwind that weighs especially heavily on high-multiple software names like ServiceNow.

The selloff has been aggravated by a notable lack of insider confidence. Management sold shares worth $2.7 million over the past few months without a single insider purchase, according to filings. Meanwhile, the stock’s annualized volatility has spiked to nearly 80%, and the Relative Strength Index stands at a neutral 50.2, suggesting the market hasn’t yet found a clear direction despite the sharp drop.

Operationally, the picture remains solid. Subscription revenue grew 22% year-over-year in the first quarter, reaching $3.77 billion, while earnings per share hit $0.97, matching consensus. Management recently raised the full-year guidance, and the company’s AI-powered “Now Assist” platform continues to draw interest from enterprise clients. The drag comes from the integration of Armis, the cybersecurity firm acquired last year. Analysts expect the deal to compress operating margins by 75 basis points and free cash flow by 200 basis points for the full year.

Despite the recent turbulence, the analyst community remains largely bullish. Of the 48 analysts covering the stock, the majority maintain buy ratings with an average price target of around €131 — implying roughly 42% upside from Wednesday’s close. Yet that optimism is tempered by technical resistance levels. The shares are still far from their 52-week high of €196, set in July 2025, and face a first meaningful wall between €110 and €113. ServiceNow must now prove that the security setback is a temporary blemish on an otherwise compelling growth narrative, while navigating a macro environment that shows no signs of easing.