ServiceNow Vulnerability Enables Full User Impersonation
On January 19, 2026, a security researcher disclosed a critical vulnerability in ServiceNow’s Virtual Agent API and Now Assist AI Agents application, tracked as CVE-2025-12420 and dubbed "BodySnatcher." The flaw allows unauthenticated attackers to impersonate any user using only an email address, bypassing MFA and SSO to execute privileged AI workflows and create backdoor administrator accounts. Enterprises should urgently apply vendor patches and audit agent integrations.
Scoring Rationale
High novelty and actionable CVE disclosure with broad enterprise impact, balanced by single-source reporting and limited technical details.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
