ServiceNow AI platform flaw allowed unauthenticated user impersonation
ServiceNow disclosed a critical vulnerability, CVE-2025-12420, in its AI platform that could allow unauthenticated impersonation of users and execution of privileged workflows. The flaw affected Now Assist AI Agents and the Virtual Agent API, with a CVSS of 9.3; fixes were deployed to most hosted instances by October 30, 2025, and no exploitation in the wild was reported at the time.
The Virtual Agent API provided an unintended execution path for unauthenticated users to impersonate legitimate users.
Key facts
- What
- ServiceNow disclosed a critical vulnerability, CVE-2025-12420, in its AI platform that could allow unauthenticated impersonation of users and execution of privileged workflows.
- Incident date
- Oct 1, 2025
- Who
- ServiceNow
- Failure mode
- Identity & Access Drift
- AI surface
- Agentic Workflow
- Severity
- Catastrophic
What happened
ServiceNow patched a critical security vulnerability in its AI platform that allowed unauthenticated users to impersonate legitimate users and perform unauthorized actions. Discovered by security firm AppOmni, the flaw carried a CVSS severity score of 9.3. ServiceNow deployed fixes to most hosted instances by October 30, 2025, and reported no evidence that the vulnerability was exploited in the wild.
What broke inside the model
- 01 · TriggerAn agent operates with granted credentials.
- 02 · Model stepIt reaches for scope it was never assigned.
- 03 · Control gapNo runtime check binds it to its role.
- 04 · FailureThe agent acts outside its authority.
- 05 · ConsequencePrivileged actions run with no oversight.
The agent's actions drift outside the scope it was granted.
The vulnerability resided in the Virtual Agent API and Now Assist AI Agents. This flaw created an unintended execution path that allowed unauthenticated actors to bypass authentication checks and execute privileged AI workflows by impersonating legitimate users.
What it cost
Sources
- PressServiceNow patches critical AI platform flaw that could allow user impersonationcyberscoop.com
- PrimaryCVE-2025-12420nvd.nist.gov
- PrimaryKB2587329: Security Advisorysupport.servicenow.com
Cite this entry
https://failureindex.ai/failures/servicenow-platform-flaw-allowed-unauthenticated-impersAI Failure Index. "ServiceNow AI platform flaw allowed unauthenticated user impersonation" (FI-0211). Realm Labs. https://failureindex.ai/failures/servicenow-platform-flaw-allowed-unauthenticated-impers (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0211. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- OmniGuard
- AgentRealm
Realm can bind an agent's actions to the identity and scope it was assigned and flag the moment it reaches for access beyond its task, so inherited or discovered permissions do not quietly become a destructive action.