ServiceNow Vulnerability Enables Privilege Escalation Without Authentication

A critical privilege escalation vulnerability has been identified in ServiceNow’s AI Platform, posing significant risks to enterprise users worldwide.

Tracked as CVE-2025-12420, this security flaw allows unauthenticated attackers to impersonate other users and execute unauthorized operations based on the compromised account’s permissions.

The vulnerability was discovered by AppOmni, a prominent SaaS security firm, and reported to ServiceNow in October 2025 through coordinated vulnerability disclosure.

This flaw poses a severe threat to organizations that rely on ServiceNow’s AI capabilities for critical business operations.

ServiceNow responded swiftly by deploying security updates to most hosted instances on October 30, 2025.

The company also provided patches to partners and self-hosted customers to address this vulnerability.

Despite the fix’s availability, ServiceNow remains unaware of active exploitation in the wild. However, the firm urges immediate action given the increased risk following public disclosure.

Two primary applications are affected by this vulnerability. The Now Assist AI Agents application requires an upgrade to version 5.1.18 or later, or version 5.2.19 or later.

The Virtual Agent API needs to be updated to version 3.15.2 or later, or to version 4.0.4 or later.

ServiceNow strongly recommends that all customers promptly apply appropriate security updates or upgrades.

Organizations should prioritize patching efforts to mitigate potential risks. The company has published comprehensive security maintenance overview articles in its knowledge base for both hosted and self-hosted deployments.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.