ServiceNow Patches Critical AI Platform Flaw Allowing Unauthenticated User Impersonation

What it is

Beyond CVE-2025-12420 (BodySnatcher), the page surfaces a second, distinct issue the summary omits: roughly two months before this disclosure, AppOmni reported that default configurations in ServiceNow's Now Assist generative-AI platform let attackers abuse its agentic capabilities for second-order prompt injection. This is a configuration-level exposure, not the account-linking/hardcoded-secret bug that the October 30, 2025 patches address.

How it works

Per the page, an attacker plants malicious instructions that a Now Assist agent later ingests and acts on (second-order prompt injection — the payload is stored, then executed when the AI processes it). Because the agent runs with the privileges of the workflow it drives, the injected instructions can be weaponized to copy and exfiltrate sensitive corporate data, modify records, and escalate privileges.

Preconditions / Affected

This one turns on default Now Assist configuration with agentic capabilities enabled — the page does not tie it to a CVE or a fixed version. That is the key difference from BodySnatcher: applying the sn_aia / sn_va_as_service patches (5.1.18+/5.2.19+ and 3.15.2+/4.0.4+) closes the impersonation flaw but does not address the default-config injection path.

What to do

The patches remediate CVE-2025-12420 only. For the prompt-injection exposure, the page gives no version fix — it points to the earlier AppOmni report on default configurations, implying engineers must review and harden Now Assist agent defaults rather than rely on the update. Anyone running Now Assist agentic workflows should treat these as two separate remediation tracks.

Caveats

The page states no in-the-wild exploitation for CVE-2025-12420, and it does not quantify or version the prompt-injection issue — it is described qualitatively via the prior disclosure, so the concrete mitigation steps live in that separate AppOmni report, not here.