CVE-2025-12420 (CVSS 9.3) Exposes Critical ServiceNow AI Impersonation Flaw

Analysis of CVE-2025-12420 (CVSS 9.3): Critical Impersonation Flaw in ServiceNow AI Platform

Estimated reading time: 6 minutes

ServiceNow recently addressed a critical security vulnerability, identified as CVE-2025-12420 (CVSS 9.3), within its AI platform. This flaw allowed unauthenticated users to impersonate legitimate accounts, potentially facilitating unauthorized actions across enterprise environments. The vulnerability was discovered in the Now Assist AI Agents and Virtual Agent API components, which are central to ServiceNow’s generative AI capabilities.

The disclosure of CVE-2025-12420 (CVSS 9.3) coincides with increased scrutiny regarding the configuration of enterprise AI systems. Research indicates that while the immediate impersonation flaw has been patched, the underlying architecture of autonomous AI agents introduces complex security challenges, including second-order prompt injection risks. Organizations relying on these tools must ensure their configurations do not inadvertently expose internal data or administrative functions to unauthorized entities.

Technical Analysis of CVE-2025-12420 (CVSS 9.3)

The CVE-2025-12420 (CVSS 9.3) vulnerability stems from a flaw in how the Now Assist AI platform handled authentication and user session data within specific API components. Specifically, the Now Assist AI Agents and Virtual Agent API were found to be susceptible to an impersonation vector. An attacker could exploit this to bypass standard authentication protocols, gaining the same level of access as the impersonated user.

Because ServiceNow is frequently used to manage sensitive IT infrastructure, HR records, and customer data, an impersonation attack carries significant risks. A successful exploit could lead to the unauthorized retrieval of internal records, modification of system configurations, or lateral movement within an organization’s network. The severity score of 9.3 reflects the high impact on confidentiality, integrity, and availability, combined with the ease of unauthenticated access.

PurpleOps utilizes a cyber threat intelligence platform to track the development of exploits targeting enterprise SaaS solutions. For CVE-2025-12420, the risk is magnified by the fact that ServiceNow instances often hold the “keys to the kingdom” for IT operations. If an attacker impersonates a system administrator via the Virtual Agent API, the scope of the breach extends to every integrated service.

The Role of Agent Discovery and Default Configurations

Beyond the primary impersonation flaw, research conducted by AppOmni identified risks associated with the “agent discovery” feature in ServiceNow’s Now Assist platform. This feature allows different AI agents to communicate and collaborate to complete complex tasks. For example, an IT support agent might “discover” and communicate with a procurement agent to fulfill a hardware request.

However, the default settings for this feature often grouped agents into teams and marked them as discoverable by default. This creates unintended communication pathways. In a scenario involving CVE-2025-12420 (CVSS 9.3), an attacker who has successfully impersonated a low-privileged user could leverage these pathways to interact with agents that possess higher privileges.

Analysts have observed increased interest in bypassing AI guardrails through the manipulation of inter-agent collaboration, effectively allowing agents to “recruit” each other for unauthorized actions.

Through underground forum intelligence, security analysts have observed increased interest in bypassing AI guardrails. In the context of ServiceNow, the research demonstrated that even when prompt injection protections were active, the way agents were grouped and allowed to collaborate could still be exploited. The agents were essentially “recruiting” each other to perform actions that the original user was not authorized to initiate.

Second-Order Prompt Injection Mechanics

One of the most concerning findings related to enterprise AI security is the prevalence of second-order prompt injection. Unlike a standard prompt injection, where a user directly inputs a malicious command, a second-order attack embeds the malicious instructions within data that the AI agent is expected to process later.

For instance, an attacker might place malicious instructions in a low-priority support ticket or a specific data field in a database. When a high-privileged AI agent-such as one used by an administrator to summarize daily logs-accesses that data, it reads and executes the embedded instructions. In the context of CVE-2025-12420 (CVSS 9.3), this could allow an attacker to maintain persistence or escalate privileges even after an initial impersonation attempt.

Enterprises must integrate supply-chain risk monitoring to evaluate how AI updates and configuration changes impact their overall security. The ServiceNow case illustrates that the security of an AI system is not solely dependent on the vendor’s code but also on the organizational choices regarding agent autonomy and data access.

Identification and Mitigation Strategies

ServiceNow deployed fixes for hosted instances on October 30, 2025. Organizations using self-hosted or partner-hosted versions must manually verify their patch levels. The following versions or later are required to mitigate CVE-2025-12420 (CVSS 9.3):

• Now Assist AI Agents: Version 5.1.18 or 5.2.19
• Virtual Agent API: Version 3.15.2 or 4.0.4

Organizations should also use breach detection tools to audit logs for any unusual activity occurring between October and the application of the patch. Specifically, look for unauthenticated API calls to the Virtual Agent components or administrative actions performed by users who were not logged in through standard SSO portals.

To further secure the environment, administrators should review the “agent discovery” settings. Disabling the automatic grouping of agents and requiring explicit authorization for inter-agent communication can reduce the attack surface for second-order prompt injections.

Integrating Intelligence into Defense

The rapid adoption of AI agents requires a proactive approach to threat monitoring. Utilizing a dark web monitoring service helps identify if specific ServiceNow instance URLs or credentials have been leaked, which are often the precursors to impersonation attacks. Furthermore, telegram threat monitoring provides insights into the latest techniques used by threat actors to manipulate AI logic and bypass filters.

When vulnerabilities like CVE-2025-12420 (CVSS 9.3) are publicized, threat actors often move quickly to develop automated scanning tools. Integrating a live ransomware API into your security operations center (SOC) can help correlate AI platform anomalies with broader ransomware campaign indicators. This is particularly important as real-time ransomware intelligence suggests that attackers are increasingly targeting SaaS administrative consoles to deploy file-encrypting payloads across the entire enterprise.

Protecting the corporate image is also vital. Brand leak alerting can notify security teams if internal data, manipulated or exfiltrated via AI agent flaws, appears on public-facing repositories or paste sites.

PurpleOps Expertise in AI and SaaS Security

PurpleOps provides deep technical expertise in securing complex SaaS ecosystems. Our approach to cyber threat intelligence ensures that organizations are not just reacting to CVEs like CVE-2025-12420 (CVSS 9.3), but are actively hardening their configurations against the next generation of AI-driven threats.

Our services include specific modules for testing AI prompt injection and agent collaboration vulnerabilities. We simulate the exact scenarios described in the ServiceNow research, identifying whether your “agent teams” are susceptible to recruitment by malicious actors.

Additionally, our focus on supply-chain risk monitoring helps organizations understand the shared responsibility model in the age of generative AI. While ServiceNow provides the patches, the configuration of Now Assist and the management of Virtual Agent API permissions remain the responsibility of the customer.

Practical Takeaways for Technical and Non-Technical Readers

For Engineers and Security Analysts:

1. Immediate Patching: Confirm all ServiceNow instances are running Now Assist AI Agents 5.1.18/5.2.19+ and Virtual Agent API 3.15.2/4.0.4+.
2. Audit Agent Configuration: Access the ServiceNow AI configuration console and review agent discovery settings. Disable “Discoverable” status for agents that do not require inter-agent communication.
3. Implement Least Privilege: Ensure AI agents are assigned the minimum necessary permissions. An agent designed for “summarizing tickets” should not have “write” access to system configurations.
4. Log Monitoring: Monitor for “401 Unauthorized” errors followed by successful high-privileged actions in the Virtual Agent API logs.
5. Test for Injection: Use specialized tools to test how AI agents handle “dirty” data from low-privileged fields.

For Business Leaders and CISOs:

1. Review AI Governance: Establish clear policies on which business processes are permitted to use autonomous AI agents.
2. Understand the Shared Responsibility: Recognize that the vendor’s security patch is only the first step; internal configuration is where most AI risks reside.
3. Invest in Monitoring: Ensure your security team has access to dark web monitoring service and underground forum intelligence to stay ahead of exploit trends targeting your SaaS stack.
4. Evaluate Supply Chain: Include AI platform configurations in your regular supply-chain security assessments.
5. Human-in-the-Loop: For high-impact actions, ensure the AI agent requires a human approval step before execution.

Conclusion and Strategic Alignment

The discovery of CVE-2025-12420 (CVSS 9.3) highlights the necessity of a multifaceted security strategy. As AI agents become more integrated into enterprise workflows, the boundary between “authenticated” and “unauthenticated” access can become blurred by complex API interactions.

PurpleOps offers the tools and expertise needed to navigate these technical challenges. From dark web monitoring to supply-chain information security, we provide the comprehensive coverage required to protect your infrastructure.

For more information on how to secure your ServiceNow environment or to schedule a specialized AI security assessment, explore PurpleOps Solutions:

• Cyber Threat Intelligence
• Dark Web Monitoring
• Supply Chain Information Security
• Protect Against Ransomware
• Red Team Operations
• PurpleOps Platform

Contact PurpleOps today to ensure your organization is protected against vulnerabilities like CVE-2025-12420 and the emerging threats targeting enterprise AI.

Frequently Asked Questions