Product:
AI Platform
Summary
A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. ServiceNow has addressed this vulnerability by deploying a relevant security update to hosted instances in October 2025. Security updates have also been provided to ServiceNow self-hosted customers, partners, and hosted customers with unique configurations.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.3 | CVE-2025-12420 |
Exploitation
To exploit this vulnerability, an attacker can leverage the lack of authentication controls to impersonate another user. By sending crafted requests over the network, the attacker can gain unauthorized access to perform actions that the impersonated user is entitled to, potentially leading to data exposure or manipulation.
Affected Products
- ServiceNow hosted instances: Security updates have been deployed to address the vulnerability.
- ServiceNow self-hosted customers: Security updates have been provided to mitigate the risk.
- ServiceNow Store App versions: The vulnerability is addressed in the listed versions.
Mitigation
Customers are advised to promptly apply the appropriate security update or upgrade their systems if they have not already done so. This will help mitigate the risk associated with the vulnerability and protect against potential exploitation.