BodySnatcher (CVE-2025-12420): agentic hijacking vulnerability in ServiceNow

What it is

BodySnatcher (CVE-2025-12420) is a critical vulnerability found by AppOmni in ServiceNow's Virtual Agent API and Now Assist AI Agents application. An unauthenticated remote attacker, knowing only a target's email address, can impersonate any user — including an administrator — bypass MFA and SSO, and drive privileged Now Assist AI agent workflows to create backdoor accounts with full privileges. The page frames it as the most severe AI-driven vulnerability disclosed to date.

How it works

Virtual Agent is ServiceNow's chatbot engine: NLU maps a user message to a pre-defined Topic (a structured workflow like password reset or ticket filing). The Virtual Agent API bridges external integrations (Slack, Teams) to these topics. Each integration maps to a provider record, located via a channel ID sent in the request. Authentication and identity are split:

• The Message Auth record holds a static credential — the provider's effective client-secret/password — presented alongside the provider ID. The exploit chains a hardcoded, platform-wide secret here.
• The Automatic Link action performs identity-linking that trusts a supplied email address, so the attacker binds the session to any user.

The page also names an internal topic, AIA-Agent Invoker AutoChat, that lets AI agents execute outside their expected deployment constraints — turning a chatbot integration into an execution path for privileged agentic workflows.

Preconditions / Affected

Affected: ServiceNow instances running specific versions of the Virtual Agent / Now Assist AI Agents applications (the page references a version table and disclosure timeline that were not present in the fetched text). Attack requires no credentials and no prior login — only network reach to the Virtual Agent API and the target's email address. Insecure provider and agent configurations are what make it exploitable.

What to do

• On-premise customers: upgrade immediately to at least the earliest fixed version of each affected application (listed in the article's vulnerability-details section, not reproduced here).
• Cloud-hosted customers: no action required.
• Beyond patching, the page prescribes configuration hardening:
• Enforce MFA for account linking in provider configuration.
• Establish an agent approval process before agents go live.
• Apply lifecycle management to de-provision unused or stagnant agents.

Caveats

The author stresses that point-in-time fixes do not eliminate the systemic risk from insecure provider and agent configurations — patching alone leaves the class of misconfiguration in place, hence the additional controls above. Exact fixed version numbers and the disclosure timeline are referenced on the page but were not captured in the fetched text; confirm them against the article before scoping an upgrade.