CISA adds six exploited flaws to its catalog

CISA has added six vulnerabilities to its Known Exploited Vulnerabilities Catalog on evidence of active exploitation, four in Plex Media Server, one in EG Secure Solutions SiteGuard Server Edition and one in Siemens Software Center, and urged organisations to prioritise remediation under Binding Operational Directive 26-04.

Why it matters: Catalog listing is reserved for flaws with evidence of real exploitation, and the Plex and Siemens products sit in homes, small networks and corporate desktops well beyond the federal systems the directive binds, so the exposure is wider than the federal remediation duty.

Data as of CISA alert dated October 20, 2026, read in full at cisa.gov; the agency is the primary authority for its own catalog. The alert states no per vulnerability remediation date; it summarises Binding Operational Directive 26-04 in general terms. Correction: an earlier version of this item misstated the directive number and a remediation date, and omitted the sixth entry; this version follows the alert page. Developing item.

The Cybersecurity and Infrastructure Security Agency said on Tuesday that it had added six new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. The six are four flaws in Plex Media Server, two server side request forgery vulnerabilities (CVE-2026-96652 and CVE-2026-96655), an improper neutralisation of encoded URI schemes flaw (CVE-2026-96654) and an external control of file name or path flaw (CVE-2026-96656), an operating system command injection vulnerability in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931), and an uncontrolled search path element vulnerability in Siemens Software Center (CVE-2026-110936).

CISA said vulnerabilities of this kind are frequent attack vectors for malicious actors and pose significant risks to the federal enterprise. Binding Operational Directive 26-04, which sets vulnerability management requirements for federal civilian agencies, requires agencies to prioritise rapid remediation of high risk catalog vulnerabilities on publicly exposed assets that grant total control after exploitation, while deferring lower risk ones, and sets expectations for checking whether attackers compromised a system before a patch was applied. The directive binds federal agencies only, and CISA encouraged all organisations to adopt risk based vulnerability management and prioritise catalog remediation in their own networks.

CISA adds six exploited flaws to its catalog

Sources