ServiceNow patches critical security flaw which could allow user impersonation

1. Pro
2. Security

ServiceNow patches critical security flaw which could allow user impersonation News By Sead Fadilpašić published 14 January 2026

It is the most severe AI-driven vulnerability ever found, researchers say

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

Image Credit: Pixabay (Image credit: Pixabay) Share Share by:

• Copy link
• Facebook
• X
• Whatsapp
• Reddit
• Pinterest
• Flipboard
• Threads

Share this article 0 Join the conversation Follow us Add us as a preferred source on Google

• ServiceNow patches critical AI Platform flaw (CVE-2025-12420) enabling user impersonation
• “BodySnatcher” scored 9.3/10 and affected multiple app versions
• No exploitation seen yet; experts warn unpatched systems remain at risk post-fix

ServiceNow, one of the most popular cloud platforms for automating IT and business workflows, has said it recently patched a critical-severity vulnerability which allowed threat actors to impersonate other users and perform arbitrary actions in their stead.

The company revealed SaaS security outfit AppOmni notified it of a critical privilege escalation vulnerability within its AI Platform in October 2025. Following an investigation, the company started tracking the bug as CVE-2025-12420 and gave it a severity score of 9.3/10 (critical).

“This issue [...] could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform,” the advisory reads. “On October 30, 2025, ServiceNow addressed this vulnerability by deploying a relevant security update to the majority of hosted instances,” it further stated. “Security updates were also provided to ServiceNow partners and self-hosted customers. Additionally, the vulnerability is addressed in the listed Store App versions.”

You may like

• Second-order prompt injection can turn AI into a malicious insider
• SAP fixes serious security issues - here's how to stay safe
• This WebUI vulnerability allows remote code execution - here's how to stay safe

Biggest bug ever?

The patches were released for these versions:

Now Assist AI Agents (sn_aia) - 5.1.18 or later and 5.2.19 or later

Virtual Agent API (sn_va_as_service) - 3.15.2 or later and 4.0.4 or later

So far, there is no evidence that the vulnerability is being abused in the wild. However, it’s not unusual for a bug to start being exploited only after the release of a fix. Many cybercriminals don’t have the knowledge or the resources to hunt for zero-days, and instead just rely on the fact that many businesses fail to patch their software on time.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

AppOmni, who discovered the flaw, dubbed it “BodySnatcher”.

"BodySnatcher is the most severe AI-driven vulnerability uncovered to date: Attackers could have effectively 'remote controlled' an organization's AI, weaponizing the very tools meant to simplify the enterprise," a researcher told The Hacker News.

Via The Hacker News

The best antivirus for all budgetsOur top picks, based on real-world testing and comparisons

➡️ Read our full guide to the best antivirus1. Best overall:Bitdefender Total Security2. Best for families:Norton 360 with LifeLock3. Best for mobile:McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

TOPICS AI Sead FadilpašićSocial Links Navigation

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Show More Comments

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Logout Read more Second-order prompt injection can turn AI into a malicious insider    SAP fixes serious security issues - here's how to stay safe    This WebUI vulnerability allows remote code execution - here's how to stay safe    HPE tells customers to patch OneView immediately as top-level security flaw spotted    Thousands of n8n instances under threat from top security issue    This SmarterMail vulnerability allows Remote Code Execution - here's what we know    Latest in Security Experts warn this new Chinese Linux malware could be preparing something seriously worrying    Thousands of n8n instances under threat from top security issue    US government told to patch high-severity Gogs security issue or face attack    Hackers claim to have Target source code for sale following recent cyberattack    Spanish energy giant Endesa says it was hit by data breach, customers affected and 20 million files allegedly put up for sale    Businesses are finally taking action to crack down on AI security risks    Latest in News Spotify claims it's not forcing AI-generated music onto listeners.    ServiceNow patches critical security flaw which could allow user impersonation    Nvidia could pivot away from RTX 5070 Ti and 5060 Ti 16GB to favor 8GB GPUs    Fender's Play platform is coming to Samsung TVs everywhere – grab your axe by summer 2026    Sega ditches Nintendo's controversial Game-Key Cards for Sonic Racing: CrossWorlds' physical Switch 2 release    "We will set a high bar" - Microsoft reveals multiple new data centers, and promises your energy bills won't go up to pay for them    LATEST ARTICLES

1. 1ServiceNow patches critical security flaw which could allow user impersonation
2. 2Docusign wants to use AI to turn your complex contracts into plain English
3. 3Experts warn this new Chinese Linux malware could be preparing something seriously worrying
4. 4The RAM shortage claims another victim as PS5 SSD prices rocket — here's why now is the worst time to buy and what to do instead
5. 5Spotify claims it's not forcing AI-generated music onto listeners.