CVE-2025-12420

Unauthenticated Privilege Escalation in ServiceNow AI Platform

Exploitation likely. EPSS gives it a 53% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile99th53% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-01-12Updated 2026-01-27Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your ServiceNow instance uses Now Assist AI Agents or Virtual Agent API and identify each installed app version.
Upgrade Virtual Agent API to 3.15.2 on the 3.x branch, 4.0.4 on the 4.x branch, or a later supported release.
Upgrade Now Assist AI Agents to 5.1.18 or later.
If you use a self-hosted instance, unique configuration, or managed setup, ask your ServiceNow contact to confirm the relevant security update has been applied.

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions. We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so.

In plain language

Written by AI from the record

This is a serious flaw in ServiceNow AI features that could let an outsider act as one of your users, so businesses using Now Assist AI Agents or Virtual Agent API should have IT verify updates now.

Unauthenticated privilege escalation in the ServiceNow AI Platform enables user impersonation and execution of operations authorized to the impersonated account.

If you're affected

User account impersonation
Unauthorized business actions
Sensitive data exposure
Service disruption

What is it

A weakness in these ServiceNow AI features may allow an outsider to pose as another user and use the permissions that person has. It is like someone obtaining a staff member’s access badge and being able to enter the rooms that employee can enter.

Who is affected

This matters to you if your organization uses Now Assist AI Agents or Virtual Agent API in ServiceNow. It is especially important for organizations that use these features to handle customer requests, employee support, or business workflows. The risk applies where those features are enabled for use.

How urgent is it

This is urgent because an attacker may be able to act as an existing user without first obtaining an account. It is not listed in CISA’s known-exploited catalog and no public exploit code is recorded, but the predicted likelihood of exploitation is high and rising; treat this as a red-priority update.

What to do — in detail

Confirm exposure by inventorying installed Store App versions for Now Assist AI Agents and Virtual Agent API, then determine whether the affected features are enabled in the instance.

For Virtual Agent API, upgrade the 3.x branch to 3.15.2 or later, or the 4.x branch to 4.0.4 or later. For Now Assist AI Agents, upgrade to 5.1.18 or later. Review app release notes and test updates in a non-production instance first, as app upgrades can affect custom integrations and workflows.

ServiceNow deployed a relevant security update to hosted instances in October 2025. Self-hosted customers, partners, and hosted customers with unique configurations should obtain confirmation from ServiceNow that the applicable update has been applied. If patching must be delayed, temporarily disable the affected AI apps or restrict their use until the update is complete, after assessing workflow impact.

CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV. Review ServiceNow audit and security logs for unexpected user impersonation, unusual privileged actions, and changes made through affected AI workflows after remediation.

Technical context

CVE-2025-12420 is rated CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-250. The reported condition permits unauthenticated impersonation of another user and execution of operations within that user’s authorization scope. It is not in CISA KEV, and no public exploit code is on record. EPSS predicts a 53.2% likelihood of exploitation and places it in the 99th percentile, with a rising trend; this is a prediction, not confirmation of exploitation. Exploit maturity is therefore unconfirmed.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

53% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 249 days, from the signal feeds we watch.

2026-09-18EPSS band changemoderate → highepss band change
2026-06-22EPSS band changelow → moderate
2026-01-27Patch availablerecord updated
2026-01-12Publishedweakness classified, att&ck mapped

Affected products

ServiceNowcommercial · USaka service-now
- Now Assist AI AgentsSaaSEnterprise Software / itsm-monitoring
- Virtual Agent APISaaSEnterprise Software / itsm-monitoring

And 2 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable