BodySnatcher (CVE-2025-12420): A Broken Authentication and Agentic Hijacking Vulnerability in ServiceNow

### Executive Summary This report describes “BodySnatcher” (CVE-2025-12420), a critical agentic-AI vulnerability in ServiceNow where a platform-wide static provider secret combined with insecure auto-linking allowed unauthenticated attackers (knowing only an email) to impersonate users, bypass MFA/SSO, and remotely invoke privileged AI agents to create admin backdoors; the document details the Virtual Agent and A2A internals, provides PoC exploit requests, and gives mitigation and governance recommendations.