# CISA KEV Adds Plex, SiteGuard, Siemens Flaws

Published: 2026-10-20 · Severity: high · Sectors: Government (National), Technology, Manufacturing
Canonical: https://vorant.io/reports/fa8fe54b-83f0-5135-b2cd-6a3c914edb82/cisa-kev-adds-plex-siteguard-siemens-flaws

> CISA added six actively exploited vulnerabilities in Plex Media Server, EG Secure Solutions SiteGuard, and Siemens Software Center to its KEV catalog.

CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation. Four of the flaws affect Plex Media Server: three are classified as Server-Side Request Forgery (SSRF) or related issues (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655) and one is an External Control of File Name or Path vulnerability (CVE-2026-96656). A fifth flaw, CVE-2026-106931, is an OS command injection vulnerability in EG Secure Solutions SiteGuard Server Edition, which could allow remote command execution. The sixth, CVE-2026-110936, is an uncontrolled search path element vulnerability in Siemens Software Center that could be exploited for DLL hijacking or local privilege escalation.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must prioritize remediation of KEV-listed vulnerabilities on publicly exposed assets, particularly those granting full control post-exploitation, and verify whether compromise occurred prior to patching. While BOD 26-04 is mandatory only for FCEB agencies, CISA urges all organizations to adopt the same risk-based patching priority for these six vulnerabilities given confirmed in-the-wild exploitation.

Defenders running Plex Media Server, EG Secure Solutions SiteGuard Server Edition, or Siemens Software Center should identify affected versions, apply vendor patches immediately, and check for indicators of prior compromise, especially on internet-facing instances. No specific threat actor or campaign is named in this advisory; CISA's listing is based solely on evidence of exploitation reported to or observed by the agency.

## Mentioned in this report

- Vulnerabilities: CVE-2026-106931 (KEV), CVE-2026-110936 (KEV), CVE-2026-96652 (KEV), CVE-2026-96654 (KEV), CVE-2026-96655 (KEV), CVE-2026-96656 (KEV)

Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/fa8fe54b-83f0-5135-b2cd-6a3c914edb82/cisa-kev-adds-plex-siteguard-siemens-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup