CISA Orders Federal Agencies to Patch ServiceNow AI Vulnerabilities Under Active Exploitation
Tap title to read story
The Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to patch three critical ServiceNow AI platform vulnerabilities by September 4, 2026. The flaws, carrying maximum severity scores of 10.0, impact the Washington DC, Vancouver, and Utah releases. ServiceNow confirmed the security issues stem from default configurations permitting unauthenticated access to unprotected file and attachment resources. Active exploitation of these flaws has been connected to the TeamPCP supply chain attack group, which allegedly compromised over 500 global organizations. Australian law enforcement recently arrested two individuals linked to the cyberattacks. Federal civilian agencies face severe risks as malicious actors target enterprise IT management platforms to access sensitive government and corporate data. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog to enforce rapid remediation across federal networks. IT teams are racing against the tight deadline as investigations into ongoing data breaches across affected enterprise instances continue nationwide.
Timeline
- On August 1, 2026 ServiceNow released security updates addressing critical platform vulnerabilities.
- On August 10, 2026 investigators linked TeamPCP group to global supply chain attacks.
- On August 15, 2026 Australian Federal Police arrested two suspects in cyber operations.
- On August 20, 2026 CISA added ServiceNow platform vulnerabilities to KEV catalog.
- On August 30, 2026 federal agencies actively work to secure vulnerable IT systems.
- On September 4, 2026 federal civilian agencies must complete required vulnerability patching mandates.
- On September 15, 2026 security researchers expect detailed post incident analysis reports publishing.
- On October 1, 2026 compliance audits will review federal agency software patch implementations.
- On November 1, 2026 regulators may introduce stricter enterprise AI platform security requirements.
- On December 31, 2026 global organizations will finish hardening enterprise software against supply exploitation.
Sources
JQJO Editorial Desk · Human reviewed · AI assisted. Report a correction.

























