{"id":149,"date":"2026-10-29T07:09:37","date_gmt":"2026-10-29T07:09:37","guid":{"rendered":"https:\/\/bugskan.com\/?p=149"},"modified":"2026-10-29T07:09:37","modified_gmt":"2026-10-29T07:09:37","slug":"servicenow-fixed-an-ai-platform-impersonation-flaw-before-its-public-disclosure","status":"publish","type":"post","link":"https:\/\/bugskan.com\/index.php\/2026\/10\/29\/servicenow-fixed-an-ai-platform-impersonation-flaw-before-its-public-disclosure\/","title":{"rendered":"ServiceNow fixed an AI-platform impersonation flaw before its public disclosure"},"content":{"rendered":"<p>ServiceNow\u2019s January 2026 advisory describes CVE-2025-12420, which could let an unauthenticated attacker impersonate another user and perform that user\u2019s permitted operations. The issue affected parts of Now Assist AI Agents and Virtual Agent API.<\/p>\n<p>ServiceNow said it deployed fixes to most hosted instances on October 30, 2025, and provided updates for other customer configurations. At disclosure, it reported no known exploitation against customer instances.<\/p>\n<p>The advisory lists fixed Now Assist branches beginning at 5.1.18 and 5.2.19, and Virtual Agent API branches at 3.15.2 and 4.0.4. Match the appropriate branch and customer configuration to the vendor\u2019s guidance rather than assuming every hosted or self-hosted instance was updated identically.<\/p>\n<p><a href=\"https:\/\/trust.servicenow.com\/notifications\/?date=2026-01\">Read the original source<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE-2025-12420 could allow unauthenticated impersonation; self-hosted and specially configured customers needed to verify their updates.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"bugskan_incident_id":"inc_06547313fba614","bugskan_event_type":"vulnerability","bugskan_response":"REVIEW","bugskan_technical_severity":"","bugskan_technical_severity_source":"","bugskan_evidence_quality":"high","bugskan_affected_scope":"Affected Now Assist AI Agents and Virtual Agent API versions listed by ServiceNow.","bugskan_recommended_next_step":"Verify the appropriate Store App or instance update for your deployment.","bugskan_who_should_check":"","bugskan_material_updated_at":"2026-01-12T00:00:00Z","bugskan_reviewer_name":"","bugskan_reviewed_at":"","bugskan_legacy_state":"mapped","bugskan_featured":false,"bugskan_sample":false,"footnotes":""},"categories":[1],"tags":[],"bugskan_format":[2],"bugskan_technology":[45],"class_list":["post-149","post","type-post","status-publish","format-standard","hentry","category-uncategorized","bugskan_format-security-brief","bugskan_technology-servicenow"],"_links":{"self":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/149","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/comments?post=149"}],"version-history":[{"count":1,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/149\/revisions"}],"predecessor-version":[{"id":356,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/posts\/149\/revisions\/356"}],"wp:attachment":[{"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/media?parent=149"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/categories?post=149"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/tags?post=149"},{"taxonomy":"bugskan_format","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_format?post=149"},{"taxonomy":"bugskan_technology","embeddable":true,"href":"https:\/\/bugskan.com\/index.php\/wp-json\/wp\/v2\/bugskan_technology?post=149"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}