Service Now Patches Critical AI Platform Flaw Allowing Unauthenticated User Impersonation

Summary: ServiceNow disclosed a now-patched critical flaw, CVE-2025-12420, with a CVSS score of 9.3, that could let an unauthenticated user impersonate another user and perform actions as that user; ServiceNow deployed a security update to most hosted instances on October 30, 2025, and shared patches with partners and self-hosted customers. AppOmni, which codenamed the flaw BodySnatcher, said the Virtual Agent integration flaw lets unauthenticated attackers impersonate any ServiceNow user using only an email address, bypassing MFA and SSO, and ServiceNow credited AppOmni's Aaron Costello with reporting it in October 2025, with no evidence of exploitation in the wild.
Why it matters: An attacker who impersonates an administrator could execute an AI agent to subvert security controls and create backdoor accounts with elevated privileges, and AppOmni describes the chain as a hardcoded, platform-wide secret combined with account-linking logic that trusts a simple email address.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-12420
Related: ⚡ Weekly Recap: Fortinet Exploits, Red Line Clipjack, NTLM Crack, Copilot Attack & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026