cyber.hendryadrian.com
Security News · cisa.gov

CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog

· Original article ↗

Summary

CISA added six vulnerabilities affecting Plex Media Server, EG Secure Solutions SiteGuard Server Edition, and Siemens Software Center to its KEV Catalog, citing evidence of active exploitation. Federal agencies must prioritize remediation under BOD 26-04.

Key points

  • CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
  • The listed products are Plex Media Server, EG Secure Solutions SiteGuard Server Edition, and Siemens Software Center.
  • The vulnerabilities include server-side request forgery, improper handling of encoded URI schemes, file path control, OS command injection, and an uncontrolled search path element.
  • BOD 26-04 requires FCEB agencies to prioritize certain KEV vulnerabilities on publicly exposed assets and to check for possible compromise before patching.
  • CISA encourages all organizations to use risk-based vulnerability management and prioritize remediation of KEV-listed vulnerabilities.

Article Details

Event Type
CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation.
Impact
The vulnerabilities affect Plex Media Server, EG Secure Solutions SiteGuard Server Edition, and Siemens Software Center. CISA says vulnerabilities of these types pose significant risks to the federal enterprise and encourages organizations to prioritize remediation; BOD 26-04 requires FCEB agencies to prioritize remediation of specified high-risk KEV vulnerabilities and check for possible compromise before patching.

CVE

CVE-2026-106931CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCVE-2026-110936CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability CVE-2026-96652CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96654CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCVE-2026-96655CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-96656CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability  

Vendors

EG Secure SolutionsCVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilitySiemensCVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability 

Products

Plex Media ServerCVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilitySiemens Software CenterCVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability SiteGuard Server EditionCVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

Related Articles