Kubernetes Visibility Agent Informer Images: Vulnerability Remediation and Patch Release Schedule Summary The KVA informer image includes third-party packages, and new vulnerabilities in these packages are disclosed continually. As a result, image scans can report new findings even when the deployed informer image has not changed. ServiceNow regularly reviews these findings and provides validated fixes according to the remediation timeframes below. Release schedule ServiceNow publishes KVA Informer patch releases when security fixes are due. Patch releases are generally published on the last working day of the month. Months with no fixes due do not produce a patch release. Latest available Informer release: 2.9.2 (September 2026)Next planned patch release: Not currently scheduled. A patch release contains security fixes and, where they apply safely, defect fixes. It does not add features and does not require a KVA store application upgrade. Remediation timeframes PriorityFixed withinUrgentAs soon as a validated fix is availableCritical30 daysHigh90 daysMedium180 daysLow365 days Priority is assessed against how the informer actually runs, so it may differ from the severity your own image scanner reports. High, Medium and Low fixes ship in the next monthly patch release. Critical and Urgent fixes ship out of band if the next monthly release falls outside the remediation window. Getting the fix Each patch release is published as a new informer image tag and a matching Helm chart version. Upgrade the informer using your existing Helm or YAML deployment method. The informer and the store application are versioned separately. Each informer release states the minimum store application version it requires, so you do not need to match version numbers exactly. For the latest informer release version, release date, compatibility information, and deployment files, see KB1564347 - Helm Chart and Kubernetes YAML file releases Found a vulnerability in your scan? Check your informer version against the latest available release first. Most vulnerabilities reported by customer scans are already fixed in a later image. Compare your deployed informer version with the latest release.If a newer release is available, upgrade and rescan.If the latest release is still affected, raise a case with ServiceNow Support with the image tag, CVE identifier, and the affected package name and version. Reporting a vulnerability Raise a case with ServiceNow Support with the image tag, CVE identifier, and the affected package name and version.