CVE-2025-12420: ServiceNow Now Assist Auth Bypass Flaw

CVE-2025-12420 Overview

A critical user impersonation vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. This authentication bypass vulnerability affects the Now Assist AI Agents and Virtual Agent API components, allowing attackers to gain unauthorized access to privileged functionality without proper authentication.

ServiceNow has addressed this vulnerability by deploying relevant security updates to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations. Additionally, the vulnerability is addressed in the listed Store App versions.

Critical Impact
Unauthenticated attackers can impersonate any user in the ServiceNow platform and perform all operations that the impersonated user is entitled to execute, potentially leading to complete compromise of enterprise IT service management systems.

Affected Products

ServiceNow Now Assist AI Agents
ServiceNow Virtual Agent API

Discovery Timeline

January 12, 2026 - CVE-2025-12420 published to NVD
January 27, 2026 - Last updated in NVD database

Technical Details for CVE-2025-12420

Vulnerability Analysis

This vulnerability is classified under CWE-250 (Execution with Unnecessary Privileges), indicating that the affected ServiceNow components execute operations without properly validating that the requesting user has appropriate authorization. The flaw resides in the authentication and session handling mechanisms of the Now Assist AI Agents and Virtual Agent API components.

The vulnerability allows unauthenticated remote attackers to bypass authentication controls entirely and assume the identity of legitimate users within the ServiceNow platform. Once impersonation is achieved, the attacker inherits all permissions and capabilities associated with the compromised user account, including administrative privileges if an admin user is targeted.

Root Cause

The root cause stems from improper validation of user identity within the ServiceNow AI Platform's authentication flow. The affected components fail to adequately verify that authentication tokens or session identifiers correspond to legitimate, authenticated users before granting access to protected operations. This execution with unnecessary privileges (CWE-250) allows the system to process requests as if they originated from authenticated users when they did not.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction, making it highly exploitable. An attacker can remotely target ServiceNow instances exposed to the network by crafting malicious requests to the Now Assist AI Agents or Virtual Agent API endpoints.

The attacker identifies a vulnerable ServiceNow instance and crafts requests that exploit the authentication bypass in the AI Platform components. By manipulating identity-related parameters or exploiting weaknesses in the token validation process, the attacker can impersonate any user in the system. Once impersonation is achieved, the attacker can perform any operation the target user is authorized to execute, including accessing sensitive data, modifying configurations, or escalating privileges further.

Detection Methods for CVE-2025-12420

Indicators of Compromise

Unusual API activity to /api/now/virtual_agent or Now Assist AI Agent endpoints from unexpected source IPs
Authentication anomalies showing operations performed by user accounts without corresponding login events
Session tokens or authentication headers that don't match expected patterns or lack proper validation signatures
Elevated privilege operations performed by accounts that typically don't require such access

Detection Strategies

Implement behavioral analysis to detect operations performed without proper authentication sequences preceding them
Monitor for API requests to Virtual Agent and AI Agent endpoints that bypass normal authentication flows
Configure SIEM rules to alert on user impersonation patterns, such as simultaneous active sessions from geographically impossible locations
Audit log analysis for operations attributed to users who were not logged in during the time of the activity

Monitoring Recommendations

Enable comprehensive API logging for all Now Assist AI Agents and Virtual Agent API endpoints
Implement real-time monitoring of authentication events and correlate with subsequent privileged operations
Deploy network-level monitoring to detect anomalous traffic patterns targeting ServiceNow AI Platform components
Configure alerts for any authentication bypass attempts or token manipulation detected in application logs

How to Mitigate CVE-2025-12420

Immediate Actions Required

Apply the ServiceNow security update immediately if using self-hosted or uniquely configured instances
Verify that hosted instances have received the automatic security patch deployed in October 2025
Review audit logs for any evidence of exploitation prior to patching
Implement network segmentation to limit exposure of ServiceNow AI Platform endpoints to trusted networks only

Patch Information

ServiceNow has deployed security updates to address this vulnerability. Hosted instances received automatic patches in October 2025. Self-hosted customers, partners, and customers with unique configurations should apply the security updates provided by ServiceNow. Refer to the ServiceNow Knowledge Base Article KB2587329 for specific patch information and upgrade instructions for Store App versions.

Workarounds

Restrict network access to Now Assist AI Agents and Virtual Agent API endpoints using firewall rules or network ACLs
Implement Web Application Firewall (WAF) rules to inspect and validate authentication headers on inbound API requests
Enable additional authentication layers such as IP allowlisting for administrative API access
Consider temporarily disabling the affected AI Platform components if immediate patching is not possible and the functionality is not business-critical

bash

# Example network restriction configuration (conceptual)
# Restrict access to ServiceNow AI endpoints to internal networks only
# Consult ServiceNow documentation for instance-specific configurations
# Review KB2587329 for official mitigation guidance