CVE-2025-12420

ServiceNow AI identity flaw enables user impersonation

ServiceNow · Now Assist AI Agents / Virtual Agent API

First documented disclosure · Review checkpoint

Summary

An unauthenticated actor could impersonate a ServiceNow user and exercise that user’s privileges.

Severity and exploitation evidence

Critical · 9.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The affected AI integration did not adequately bind claimed identity to authenticated authority.

Conditions required

A vulnerable Store App or instance configuration exposing the affected integration.

Potential impact

Unauthorized access and operations permitted to the impersonated account.

Affected versions and configurations

Now Assist AI Agents 5.0.26–5.1.17 and through 5.2.18 as listed by the CNA; Virtual Agent API before 3.15.2 / 4.0.4 on the corresponding branches.

Fix and mitigation status

Hosted-instance update deployed October 2025; Virtual Agent API 3.15.2 / 4.0.4. Apply the appropriate vendor update for other configurations.

Practical next steps

Confirm hosted remediation and apply the appropriate supplied update to self-hosted or specially configured instances.

Operating lesson

Bind agent identity to verified authentication rather than user-supplied account attributes.

Evidence and limits

The CVE year is 2025 but public publication is January 2026. The CNA’s overlapping AI Agents ranges are preserved rather than converted into an unsupported single range.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources