City-Forum Targets Salesforce and ServiceNow Portals

The City-Forum Salesforce and ServiceNow campaign targets public-facing portals by looking for information exposed to unauthenticated guest users.

The campaign is notable because it is not currently reported to exploit a vulnerability in Salesforce or ServiceNow. Instead, City-Forum reportedly uses legitimate public-facing application functionality to find records organizations have made accessible through overly permissive guest-user permissions, sharing rules, search sources, or portal configurations.

That distinction makes City-Forum less a story about breaking into SaaS platforms and more a warning about what happens when anonymous access extends further than intended.

City-Forum incident snapshot

Information current as of August 14, 2026. The campaign details and indicators discussed here reflect publicly available reporting at the time of publication.

What is the City-Forum data-theft campaign?

City-Forum is a data-theft campaign that reportedly searches public Salesforce and ServiceNow portals for information accessible without authentication.

BleepingComputer reported the campaign based on research from Reco. Researchers associated observed activity with the IP address 158.220.87.79, hosted by Contabo, and said requests commonly used the Go-http-client/1.1 user agent.

City-Forum has reportedly targeted organizations across multiple industries, including enterprise and public-sector environments.

The defining characteristic of City-Forum is its reliance on guest access.

Rather than first compromising an authenticated user, the attacker looks for information that a portal already allows an anonymous visitor to retrieve. Reco said it has observed guest-user activity so far.

That makes authorization boundaries and SaaS configuration central to understanding the campaign.

How City-Forum probes Salesforce Aura and LWR endpoints

City-Forum reportedly targets Salesforce Experience Cloud by probing Aura endpoints and Salesforce UI API GraphQL interfaces on LWR sites for records available to unauthenticated guest users.

Salesforce Experience Cloud allows organizations to build public-facing sites and customer experiences. Public functionality can require a guest-user profile so visitors can interact with selected resources without signing in.

City-Forum looks for situations where that access extends further than the organization intended.

On Aura-based Salesforce sites, the campaign reportedly probes endpoints including:

• /aura
• /s/sfsites/aura

The attacker can use exposed application functionality to identify information available under the site’s guest permissions and attempt to retrieve accessible records. Reported targets include information associated with objects such as accounts, contacts, and cases.

City-Forum also reportedly targets newer Lightning Web Runtime (LWR) deployments.

On LWR sites, the campaign queries Salesforce UI API GraphQL endpoints to enumerate records exposed through overly broad guest profile permissions. Although the technical interface differs from Aura, the underlying security issue remains the same: an unauthenticated request may receive data if the site’s guest-user configuration permits access.

This is why simply blocking a particular endpoint does not address the root cause. If a guest profile still has excessive access, other legitimate application interfaces may continue to expose the same underlying information.

Salesforce provides controls for determining which objects, records, and fields guest users can access. Organizations running public Experience Cloud sites should therefore review the effective permissions of their guest profiles rather than assuming that unauthenticated visitors can only see intentionally public content.

How City-Forum queries ServiceNow search sources anonymously

On ServiceNow, City-Forum reportedly sends anonymous requests to the Service Portal search API, including POST /api/now/sp/search, to enumerate information exposed through search sources available to unauthenticated users.

ServiceNow portals can intentionally provide functionality to unauthenticated visitors. That public access is not inherently a vulnerability.

The risk appears when a search source or related portal configuration exposes information that should require authentication.

City-Forum reportedly takes advantage of that distinction by querying Service Portal search functionality without signing in. If configured search sources allow guest users to retrieve sensitive information, the attacker may be able to enumerate that data through normal application behavior.

ServiceNow provides access controls for public portal content, including user criteria that can determine who can access pages, widgets, and search sources.

For administrators, the relevant question is therefore not simply whether a ServiceNow portal is publicly accessible. It is which search sources and underlying information an anonymous visitor can actually query.

Is City-Forum exploiting a Salesforce or ServiceNow vulnerability?

No Salesforce or ServiceNow software vulnerability has been reported as the basis of the City-Forum campaign.

That distinction is important.

The available reporting does not establish that City-Forum:

• Exploits a Salesforce or ServiceNow zero-day;
• Bypasses authentication;
• Defeats MFA;
• Steals user credentials;
• Compromises administrator accounts; or
• Executes malware on target systems.

Reco has reportedly observed guest-user activity rather than authenticated account compromise.

City-Forum should therefore be understood as an access-control and SaaS configuration problem based on currently available evidence. The attacker is attempting to retrieve information the application already permits an unauthenticated session to access.

That also changes the defensive response.

Patching an endpoint will not correct an overly broad Salesforce guest profile or a ServiceNow search source available to anonymous users. Organizations need to examine the effective authorization rules governing their public portals.

City-Forum indicators defenders can investigate

Reco reported several indicators associated with observed City-Forum activity.

These indicators can provide useful starting points for investigation, but organizations should avoid treating them as permanent signatures.

Infrastructure and user-agent strings can change. Beyond known campaign indicators, defenders can also investigate unexpected or high-volume anonymous requests as a behavioral hunting heuristic.

Security teams should therefore combine known campaign indicators with reviews of public portal activity and effective guest permissions.

How to reduce City-Forum exposure in Salesforce and ServiceNow

The primary defense against City-Forum is reducing unnecessary anonymous access to Salesforce records and ServiceNow search sources.

Organizations operating public portals should prioritize the following actions.

1. Audit Salesforce Experience Cloud guest profiles

Review which objects, records, and fields each site’s guest-user profile can access.

Guest permissions should support only the public workflows the organization intentionally provides.

2. Review Salesforce sharing rules and record exposure

Check guest-user sharing rules and other mechanisms that can make records available to unauthenticated visitors.

Pay particular attention to objects containing customer, contact, case, account, or service information.

3. Test Salesforce sites while logged out

Review the portal from the perspective City-Forum uses: an unauthenticated visitor.

Test public pages, searches, object access, and direct record paths without relying solely on the administrator’s view of the configuration.

The goal is to validate the effective access available externally.

4. Review ServiceNow search sources and user criteria

Identify which Service Portal search sources are accessible without authentication.

Review the associated Who Can View and Who Cannot View controls and confirm that guest users can retrieve only intentionally public information.

5. Investigate unusual anonymous enumeration

Look for abnormal volumes or patterns of anonymous requests involving Salesforce Aura endpoints, UI API GraphQL interfaces used by affected LWR sites, or ServiceNow Service Portal search functionality.

Known City-Forum indicators can help prioritize investigation, but behavioral monitoring remains important because attacker infrastructure can change.

6. Establish recurring guest-access reviews

Portal permissions change as applications, integrations, business processes, and datasets evolve.

Organizations should periodically reassess public access rather than treating the configuration made at deployment as permanently safe.

This is particularly important when new Salesforce objects, ServiceNow search sources, portal components, or sharing rules are introduced.

Where Hexnode fits around the City-Forum access-control gap

City-Forum primarily exposes a SaaS authorization and configuration problem. If Salesforce or ServiceNow makes information available to unauthenticated guest users, the immediate remediation is to correct those guest permissions, sharing rules, search sources, or portal configurations.

Hexnode UEM can report managed-device compliance to Microsoft Entra ID for compliance-based Conditional Access decisions. It also supports a separate Okta Device Trust integration.

Hexnode UEM: establish device compliance for authenticated access

Hexnode UEM can help organizations establish and evaluate compliance requirements for managed devices.

When integrated with Microsoft Entra ID Conditional Access, Hexnode UEM can report managed-device compliance information to Microsoft Entra ID, which can use that status when determining whether to grant or block access to configured resources. This allows organizations to incorporate managed-device compliance into decisions about access to protected organizational resources.

For organizations using Microsoft Entra Conditional Access, Hexnode UEM provides device-compliance information that Microsoft Entra ID can use when determining whether to grant or block access to configured organizational resources.

In the documented Microsoft Entra ID Conditional Access workflow, Hexnode UEM acts as the third-party compliance partner and reports managed-device compliance information to Microsoft Entra ID for access decisions. Salesforce and ServiceNow guest-user exposure should be addressed through the respective platform controls.

Hexnode IdP: strengthen identity and application access controls

Hexnode IdP complements that device layer with identity and access controls.

It supports conditional access based on user identity, device compliance, and security context, along with RBAC, two-factor MFA, contextual authentication, and federated identity integration with providers such as Microsoft Entra ID and Google Workspace. Administrators can also control which users and groups can access integrated enterprise applications.

For authenticated application access, Hexnode IdP can enforce access rules based on user identity, device compliance, and security context, and provide policy-controlled access to approved applications.

Hexnode UEM and Hexnode IdP can support device-compliance and identity controls around authenticated application access. Guest-user permissions and public data exposure within Salesforce and ServiceNow should be addressed through the respective platform controls.

Separately, Hexnode UEM can provide device-compliance state to Microsoft Entra ID for Conditional Access decisions, while Hexnode IdP can enforce identity- and context-based access controls for approved applications.

Featured resource

Hexnode IdP Solution Brief

See how Hexnode IdP brings identity, device posture and access controls together to help secure enterprise application access.

Download the Datasheet

FAQs

What City-Forum changes about SaaS security

City-Forum illustrates a security problem that is easy to underestimate: data can become exposed without an attacker defeating an authentication control at all.

Public Salesforce and ServiceNow portals have legitimate reasons to support unauthenticated users. The security boundary depends on ensuring those users receive access only to the information required for those public workflows.

When guest permissions, sharing rules, or search sources extend beyond that boundary, legitimate SaaS functionality can become an enumeration path.

For enterprises, the response should therefore extend beyond watching the current City-Forum IP address or user agent.

Security and SaaS administration teams should regularly test portals from a logged-out perspective, enforce least privilege for guest users, review changes to public access, and investigate abnormal anonymous queries.

Endpoint and identity controls can help protect the administrators responsible for those environments. But the central lesson from City-Forum is more fundamental: public access should be treated as an authorization boundary that requires the same deliberate review as authenticated access.