CISA KEV Adds Plex, SiteGuard, Siemens Flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CISA added six actively exploited vulnerabilities in Plex Media Server, EG Secure Solutions SiteGuard, and Siemens Software Center to its KEV catalog.
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation. Four of the flaws affect Plex Media Server: three are classified as Server-Side Request Forgery (SSRF) or related issues (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655) and one is an External Control of File Name or Path vulnerability (CVE-2026-96656). A fifth flaw, CVE-2026-106931, is an OS command injection vulnerability in EG Secure Solutions SiteGuard Server Edition, which could allow remote command execution. The sixth, CVE-2026-110936, is an uncontrolled search path element vulnerability in Siemens Software Center that could be exploited for DLL hijacking or local privilege escalation.
Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those granting full control post-exploitation, and verify whether compromise occurred prior to patching. While BOD 26-04 is mandatory only for FCEB agencies, CISA urges all organizations to adopt the same risk-based patching priority for these six vulnerabilities given confirmed in-the-wild exploitation.
Defenders running Plex Media Server, EG Secure Solutions SiteGuard Server Edition, or Siemens Software Center should identify affected versions, apply vendor patches immediately, and check for indicators of prior compromise, especially on internet-facing instances. No specific threat actor or campaign is named in this advisory; CISA's listing is based solely on evidence of exploitation reported to or observed by the agency.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,715 reports from 143 sources, 512 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs