CVE-2025-12420 is a critical (9.8) flaw in the ServiceNow AI Platform that could let an unauthenticated user impersonate another user. ServiceNow patched hosted instances in October 2025 and has issued updates for self hosted customers and fixed Store App versions. Apply the update from the advisory.
What's affected
The record lists ServiceNow Now Assist AI Agents and the Virtual Agent API. ServiceNow says it deployed a security update to hosted instances in October 2025, and that updates were also provided to self hosted customers, partners and hosted customers with unique configurations. The vulnerability is also addressed in listed Store App versions.
The specific app versions are in the ServiceNow knowledge base article KB2587329. That page loaded for me with only its title, so I cannot list the version numbers here. Read the article on the ServiceNow support site.
The CVSS vector is AV:N/AC:L/PR:N/UI:N, rated high on confidentiality, integrity and availability.
How to check if you're exposed
Check your type of instance and installed apps.
- If your instance is hosted by ServiceNow, confirm in the knowledge base article that it was updated. ServiceNow says it deployed the update in October 2025.
- If you self host, or your instance has a unique configuration, check that the platform update from the advisory has been applied.
- In the Store, review the installed versions of Now Assist AI Agents and any app that exposes the Virtual Agent API, and compare them to the versions in KB2587329.
- Review the audit trail for actions taken by users who were not signed in at the time.
What to do now
- Open KB2587329 on the ServiceNow support site and note the fixed platform and Store App versions.
- Confirm hosted instances received the October 2025 update, and apply updates yourself on self hosted ones.
- Update the affected Store Apps to the fixed versions.
- Review integrations that call the Virtual Agent API and restrict them to the services that need them.
- Review recent actions by privileged users for entries you cannot explain.
Why it matters
The record lists CWE-250, execution with unnecessary privileges. In practice the description is about impersonation, where a caller without credentials acts as another user and does what that user is allowed to do. The more powerful the impersonated user, the more damage can be done.
AI agents and virtual agents often act on behalf of users and call internal workflows. That makes identity handling in them especially important. The same advice applies to any automation layer, give it the least privilege that works and log what it does in the name of a user.
Quick check
Do hosted customers need to do anything?
ServiceNow says it updated hosted instances in October 2025. Confirm in the knowledge base article and check any Store Apps it lists.
Sources
Last reviewed: 19 October 2026.
