The Guest Portal Nobody Accounted for Until an Outsider Exploited it
On August 12, 2026, Reco, a SaaS security vendor, published details of a campaign it calls City-Forum, named after a domain tied to the attacker’s infrastructure. The campaign has been running since March 2025. Over 17 months, on the same IP address, never rotated once, targeting Salesforce Experience Cloud sites and ServiceNow Service Portals across more than 1,000 organizations: telecoms, banks, financial-services firms, enterprise software vendors, and public-sector agencies.
No platform was hacked. No zero-day was exploited. Salesforce and ServiceNow both functioned exactly as designed, the entire time.
What Actually Happened
Every Salesforce Experience Cloud site and every ServiceNow instance ships with a built-in guest identity. This isn’t a placeholder or an edge case. Per ServiceNow’s own community documentation, the guest user handles every unauthenticated transaction on the platform: unauthenticated portal browsing, inbound email processing before a sender is verified, the handshake during SSO login. It’s a real, persistent account, and by ServiceNow’s own description, it’s deliberately built to run in global scope, meaning broad access by architectural design, not a scoped-down afterthought.
What that guest identity can actually see is governed entirely by configuration choices an administrator made, usually once, at setup. A Knowledge Article stays hidden from guests unless someone explicitly marks it public. A portal widget stays restricted unless someone unchecks that restriction. None of this is automatic, and none of it is secured by default. Someone has to actively decide, and continue deciding, what the guest account can reach.
City-Forum’s tooling didn’t break any of this. It queried it, systematically, at scale, across two different technical surfaces. On Salesforce, it hit both the older Aura framework, over 560,000 scrape events logged against a single target alone, and a newer, largely undocumented LWR/GraphQL layer that Reco says it hasn’t seen targeted anywhere else. It also probed every site for open self-registration, since a guest who can self-register often inherits far more access than the guest profile alone provides. On ServiceNow, it hammered a single native search endpoint with almost no public documentation, /api/now/sp/search, and what came back depended entirely on how each individual instance’s Knowledge Base and catalog search sources had been configured.
Reco’s own framing is the cleanest summary available: every byte the attacker retrieved was something a site owner had already exposed to anonymous users.
The Part Worth Sitting With
This is not a story about a vendor failing. It’s a story about more than 1,000 separate organizations, with no coordination between them, independently making the same configuration decision and never once revisiting it.
Not because the mistake is rare or advanced. Because almost nothing in a typical IT operating rhythm ever prompts anyone to go back and re-check a permission that was set correctly, or at least set once, years ago. A guest access scope gets configured at launch, the site goes live, the business moves on, new data gets added, new integrations get connected, the org changes shape entirely, and the guest identity’s original scope just sits there, untouched, quietly drifting further from what anyone would actually approve if they looked at it fresh today.
The infrastructure running the other side of this campaign makes the same point from a different angle. Reco notes the attacker’s own VPS has sat more than a year behind on basic software patches the entire time it’s been running, because whoever operates it apparently never worried about being found. Minimal effort, sustained for 17 months, against a mistake nobody was actively looking for. That asymmetry is the actual story: it didn’t take a sophisticated adversary. It took one unmaintained server and a very long stretch of nobody checking.
Attribution here remains genuinely open. Reco notes some technique overlap with known ShinyHunters campaigns but explicitly declines to make that call, pointing to real operational differences, including the discipline of running one unrotated IP for over a year, unusual for most threat actors.
What This Actually Reveals
A permission decision made once does not expire on its own, and it does not announce itself as wrong later. It was correct, or at least acceptable, on the day someone configured it. Every day after that, as the organization changes around it, it can quietly become something nobody would sign off on anymore, and nothing about the system flags that drift. It just sits there, technically unchanged, functionally different.
Across more than 1,000 organizations, the only thing that eventually surfaced this wasn’t an internal audit, a scheduled review, or an alert from either platform. It was a third-party security vendor building dedicated detection tooling for exactly this blind spot, and choosing to publish what it found. Every one of those organizations had been exposed, in some cases for over a year, before they had any way of knowing.
That’s not a failure of effort. Most of these organizations likely have real security teams, real audit calendars, real compliance programs. It’s a failure of what gets checked, because a guest permission set once at launch rarely makes it onto anyone’s list of things to revisit, right up until the day someone outside the organization tells you it should have been.
The Question This Leaves You With
Somewhere in your own environment, there’s almost certainly a permission, a sharing rule, a default access scope, set once, by someone who may not even work there anymore, that was correct on the day it was configured and has not been looked at since. Not because anyone was careless. Because nothing in the normal rhythm of running IT ever forces that kind of recheck.
City-Forum didn’t need a vulnerability to run for 17 months across 1,000 companies. It needed exactly that: a decision nobody thought to revisit, and enough time for that to stop mattering to anyone until it was too late to matter quietly.
