TECHNOLOGY

CISA Orders Federal Agencies to Patch ServiceNow AI Vulnerabilities Under Active Exploitation

PUBLISHED Aug 29, 2026, 9:32 PM ET

Read, Watch or Listen

CISA Orders Federal Agencies to Patch ServiceNow AI Vulnerabilities Under Active Exploitation

The Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to patch three critical ServiceNow AI platform vulnerabilities by September 4, 2026. The flaws, carrying maximum severity scores of 10.0, impact the Washington DC, Vancouver, and Utah releases. ServiceNow confirmed the security issues stem from default configurations permitting unauthenticated access to unprotected file and attachment resources. Active exploitation of these flaws has been connected to the TeamPCP supply chain attack group, which allegedly compromised over 500 global organizations. Australian law enforcement recently arrested two individuals linked to the cyberattacks. Federal civilian agencies face severe risks as malicious actors target enterprise IT management platforms to access sensitive government and corporate data. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog to enforce rapid remediation across federal networks. IT teams are racing against the tight deadline as investigations into ongoing data breaches across affected enterprise instances continue nationwide.

By James Porter | JQJO News

Timeline of Events

On August 1, 2026 ServiceNow released security updates addressing critical platform vulnerabilities.
On August 10, 2026 investigators linked TeamPCP group to global supply chain attacks.
On August 15, 2026 Australian Federal Police arrested two suspects in cyber operations.
On August 20, 2026 CISA added ServiceNow platform vulnerabilities to KEV catalog.
On August 30, 2026 federal agencies actively work to secure vulnerable IT systems.
On September 4, 2026 federal civilian agencies must complete required vulnerability patching mandates.
On September 15, 2026 security researchers expect detailed post incident analysis reports publishing.
On October 1, 2026 compliance audits will review federal agency software patch implementations.
On November 1, 2026 regulators may introduce stricter enterprise AI platform security requirements.
On December 31, 2026 global organizations will finish hardening enterprise software against supply exploitation.

News Intelligence

Immediate US impact: Federal civilian agencies must urgently patch critical software vulnerabilities.
Possible long-term US impact: Stricter security mandates will govern enterprise artificial intelligence platforms.
Most affected groups: Federal agencies, IT departments, government contractors, enterprise software users.
Reader priority: Official CISA advisories and verified ServiceNow security patch documentation.