[Security Advisory] CVE-2025-12420 - Privilege Escalation in ServiceNow AI Platform - Security

[Security Advisory] CVE-2025-12420 - Privilege Escalation in ServiceNow AI Platform  ServiceNow Posture January, 2026 This advisory details CVE-2025-12420, which was addressed by ServiceNow in October 2025. At this time, ServiceNow is unaware of this issue being exploited in the wild against customer instances. However, due to the potential for increased risk when vulnerabilities are publicly disclosed, we recommend that hosted and self-hosted customers review this advisory and the linked KBs to understand what actions, if any, are required.

Here’s what you need to know In October 2025, AppOmni, a SaaS security firm, notified ServiceNow about a critical privilege escalation vulnerability that existed within the ServiceNow AI Platform. This issue, tracked as CVE-2025-12420, could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.

On October 30, 2025, ServiceNow addressed this vulnerability by deploying a relevant security update to the majority of hosted instances. Security updates were also provided to ServiceNow partners and self-hosted customers. Additionally, the vulnerability is addressed in the listed Store App versions.

Here’s what you need to do We recommend that customers promptly apply an appropriate security update or upgrade if they have not already done so. Below are the versions where this issue was addressed:

Store Application Name (App ID) Version Now Assist AI Agents (sn_aia) 5.1.18 or later 5.2.19 or later Virtual Agent API (sn_va_as_service)

3.15.2 or later 4.0.4 or later

We thank AppOmni and Aaron Costello for collaborating on this issue through the coordinated vulnerability disclosure process.

Additional Resources CVE-2025-12420: https://www.cve.org/CVERecord?id=CVE-2025-12420 [Requires NOW Login] AI Security Maintenance - October 2025 - Overview KB: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2587317 [Self-Hosted Customers Only] Self-Hosted - AI Security Maintenance - October 2025 - Overview KB: https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2587366 Change Log Version Published Summary of Changes 1.0 January 12, 2026 Initial publication