CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog, Spanning Plex Media Server, SiteGuard, and Siemens

The U.S. Cybersecurity and Infrastructure Security Agency added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 20, 2026, based on evidence of active exploitation in the wild. The batch spans three distinct product families: four vulnerabilities in Plex Media Server, one in EG Secure Solutions' SiteGuard Server Edition web application firewall, and one in Siemens Software Center.

The Six CVEs, As CISA Lists Them

CISA's alert does not specify affected version ranges for any of the six products. Organizations should consult their respective vendor advisories to determine exact exposure scope.

The Plex Cluster: Four Flaws Chained for Remote Code Execution

Secondary coverage from BleepingComputer and The Hacker News describes the four Plex CVEs as part of an attack campaign researchers are calling Plex2Shell — a name that does not appear in the CISA primary alert itself. According to that secondary reporting, attackers chain two SSRF vulnerabilities (CVE-2026-96652 and CVE-2026-96655), one URI encoding bypass (CVE-2026-96654), and one path traversal flaw (CVE-2026-96656) to achieve unauthenticated remote code execution against exposed Plex Media Server instances. The CISA alert confirms active exploitation of all four; the campaign name and payload characterizations come from third-party researchers, not CISA.

Plex Media Server is common in both consumer and enterprise media environments. Shadow IT deployments on corporate networks are a particular concern where the product may be running unmanaged and internet-exposed. Updated release notes and downloads are available at plex.tv/media-server-downloads.

SiteGuard Server Edition: OS Command Injection Under Active Exploitation

CVE-2026-106931 is an OS command injection flaw in EG Secure Solutions' SiteGuard Server Edition, a web application firewall product. OS command injection vulnerabilities allow attackers to execute arbitrary operating system commands by supplying malicious input that the application passes to a system shell. CISA's listing confirms this class of flaw is being actively exploited. SiteGuard Server Edition is deployed primarily in Japanese enterprise and government environments; operators in those markets should treat this as an immediate priority. Remediation guidance should be sought directly from EG Secure Solutions.

Siemens Software Center: Uncontrolled Search Path

CVE-2026-110936 affects Siemens Software Center and is classified as an uncontrolled search path element vulnerability. Windows Forum's coverage frames this as a DLL sideloading vector — a class of attack where an attacker places a malicious DLL in a location the application searches before reaching the legitimate path — though CISA's primary alert does not include that characterization directly. Organizations using Siemens Software Center for product lifecycle management should consult Siemens ProductCERT for patching guidance.

Remediation Requirements Under BOD 26-04

The CISA alert references Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk, which replaced the earlier BOD 22-01. Under BOD 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets where successful exploitation would grant an attacker total control of the asset. The directive also requires agencies to assess whether threat actors may have compromised a system before a patch was applied.

The CISA alert does not publish a specific per-CVE remediation deadline in the extracted primary text. Organizations should check the live KEV JSON feed for current due-date assignments for this batch.

While BOD 26-04 applies only to FCEB agencies, CISA explicitly encourages all organizations to adopt risk-based vulnerability management and treat KEV entries as priority remediation targets.

What Defenders Should Do First

Asset inventory across all three product families. Identify any internet-exposed Plex Media Server instances. Confirm whether SiteGuard Server Edition is deployed in your web application layer. Audit Siemens Software Center installations, particularly on systems with access to sensitive OT or product environments.

Patch availability. CISA's alert does not link to specific vendor patch pages. Plex release notes are at plex.tv/media-server-downloads. SiteGuard guidance should be obtained from EG Secure Solutions directly. Siemens advisories are at Siemens ProductCERT.

Compromise assessment. Under BOD 26-04, agencies must check for signs of pre-patch compromise. Even for non-federal organizations, given the active exploitation status of the Plex cluster, log review for anomalous SSRF-pattern requests and unexpected outbound connections from media server hosts is prudent before or alongside patching.

Exploitation timeline context. Rapid7's Q3 2026 Quarterly Threat Landscape report, covered by CSO Online, found that attackers weaponized high-severity flaws within an average of 72 hours of public disclosure, and that nearly 80% of exploited vulnerabilities this quarter were reachable remotely with no authentication required — the same profile as the Plex SSRF and path-traversal cluster. Organizations that still operate on monthly patching cycles are likely already behind on this batch.

Primary source: CISA KEV alert, October 20, 2026. Affected version ranges were not specified in the primary CISA alert at time of publication. Per-CVE BOD 26-04 remediation deadlines should be confirmed against the live KEV catalog. The Plex2Shell campaign name is drawn from secondary researcher reporting, not CISA's own advisory.