PT-2026-2305 · Servicenow · Servicenow Ai Platform

Published 2026-01-12 · Updated 2026-01-13 · CVE-2025-12420

Positive Technologies · (AI Summary)

CVSS v4.0

9.3

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/S:N/AU:Y/R:U/V:C/RE:H/U:Amber

Name of the Vulnerable Software and Affected Versions ServiceNow AI Platform (affected versions not specified)

Description A flaw exists in the ServiceNow AI Platform that allows an unauthenticated user to impersonate another user and perform actions with the impersonated user's permissions. This is due to an IDOR (Insecure Direct Object Reference) pattern.

Recommendations Apply the security update deployed in October 2025. If self-hosted, apply the security update provided by ServiceNow. If using a Store App, upgrade to a version with the security update.

Fix

LPE

Information Disclosure

Weakness Enumeration

CWE-200

CWE-250

Related Identifiers

CVE-2025-12420

Affected Products

Servicenow Ai Platform

References · 11

• https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB2587329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12420 · Security Note
• https://twitter.com/CVEnew/status/2010832529431908354 · Twitter Post
• https://twitter.com/0xT3chn0m4nc3r/status/2011045758900875407 · Twitter Post
• https://twitter.com/0dayPublishing/status/2010829404285341826 · Twitter Post
• https://twitter.com/xplain_it_again/status/2010964470084903036 · Twitter Post
• https://twitter.com/photogrim_/status/2011044793338503374 · Twitter Post
• https://twitter.com/ThreatSynop/status/2011037239002743181 · Twitter Post
• https://twitter.com/threatcluster/status/2011045713187156059 · Twitter Post
• https://twitter.com/zoomeye_team/status/2011015693127541087 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1qbpj8x/servicenow_patches_critical_ai_platform_flaw · Reddit Post