CISA Orders Federal Agencies to Patch ServiceNow AI Vulnerabilities Under Active Exploitation
Tap title to read story
The Cybersecurity and Infrastructure Security Agency has ordered federal civilian agencies to patch three critical ServiceNow AI platform vulnerabilities by September 4, 2026. The flaws, carrying maximum severity scores of 10.0, impact the Washington DC, Vancouver, and Utah releases. ServiceNow confirmed the security issues stem from default configurations permitting unauthenticated access to unprotected file and attachment resources. Active exploitation of these flaws has been connected to the TeamPCP supply chain attack group, which allegedly compromised over 500 global organizations. Australian law enforcement recently arrested two individuals linked to the cyberattacks. Federal civilian agencies face severe risks as malicious actors target enterprise IT management platforms to access sensitive government and corporate data. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog to enforce rapid remediation across federal networks. IT teams are racing against the tight deadline as investigations into ongoing data breaches across affected enterprise instances continue nationwide.