CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on 20 October on evidence of active exploitation: Plex Media Server CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 (server-side request forgery, improper neutralisation of encoded URI schemes, and external control of file name or path); EG Secure Solutions SiteGuard Server Edition OS command injection CVE-2026-106931; and Siemens Software Center uncontrolled search path element CVE-2026-110936. Under Binding Operational Directive 26-04, federal civilian executive branch agencies must prioritise rapid remediation of KEV-listed flaws on publicly exposed assets that grant total control post-exploitation, and must check whether systems were compromised before the patch was applied. The SiteGuard flaw — already exploited in the wild with root/SYSTEM privileges — was covered in the 19 October edition; what is new is its formal KEV listing a day later, alongside four Plex and one Siemens entry. Six additions in one day resets the remediation clock for every agency running Plex, SiteGuard or Siemens Software Center.

• Source article