On 20 October 2026, CISA, the US cyber agency, listed six more software flaws that it says attackers are using. They join its Known Exploited Vulnerabilities (KEV) catalog. Four are in Plex Media Server. Two are server-side request forgery bugs (CVE-2026-96652, CVE-2026-96655), one concerns encoded web addresses (CVE-2026-96654), and one concerns file names or paths (CVE-2026-96656). The other two are OS command injection in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) and an uncontrolled search path in Siemens Software Center (CVE-2026-110936).
CISA's alert does not say who is attacking, how many systems are hit, or which versions are affected. It does not say whether fixes exist. In general terms, server-side request forgery tricks a server into making requests for an attacker. Command injection lets an attacker run their own commands on the host. An uncontrolled search path can make a program load a file the attacker planted.
Under Binding Operational Directive 26-04, US federal civilian agencies must fix KEV flaws first, mainly on exposed systems that attackers could fully control. CISA only encourages other organisations to follow that approach. For budget holders, the list ranks work by known attacks. Is Plex or SiteGuard running on exposed or corporate hosts? Who owns patching for them?