CISA has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, the US government's list of flaws it has evidence attackers are using in the wild. Four of them are in Plex Media Server, and CISA's entries say each of the four can be chained with the other three. The other two affect EG Secure Solutions SiteGuard Server Edition and Siemens Software Center. All six were added on October 20.
A KEV listing is a statement about exploitation, not a technical write-up. CISA's entries give a short description, the NVD records carry a CVSS score, and the vendors' own advisories hold the affected and fixed versions. CISA has not flagged any of the six as known to be used in ransomware campaigns, and it has not said who is exploiting them.
Four Plex bugs, listed as one chain
Ordered by severity, the Plex entries are:
- CVE-2026-96656 (CVSS 8.6): an external control of file name or path flaw that CISA says can allow an admin user to write arbitrary files that may be executed on load.
- CVE-2026-96654 (CVSS 6.9): improper neutralization of encoded URI schemes in a web page, which CISA says could let an attacker call other plugins' functions and supply their own parameters.
- CVE-2026-96652 (CVSS 5.3): a server-side request forgery (SSRF) flaw, meaning the server can be made to send requests on somebody else's behalf. CISA says an attacker using any X-Plex-Token value can force the Plex server to POST to a destination of the attacker's choosing.
- CVE-2026-96655 (CVSS 5.3): a second SSRF flaw that CISA says lets an authenticated user request arbitrary internal or external addresses through the universal transcode path.
Individually, most of these scores are moderate. But CISA's descriptions cross-reference every one of the four bugs to the other three as chainable, which is the reason to treat them as a single patching job rather than four separate tickets. CISA has not published how the chain is being used in practice.
SiteGuard and Siemens round out the batch
- CVE-2026-106931 (CVSS 8.5): an OS command injection vulnerability in EG Secure Solutions SiteGuard Server Edition that CISA says may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the product.
- CVE-2026-110936 (CVSS 8.4): an uncontrolled search path element vulnerability in Siemens Software Center that CISA says could let an authenticated local attacker place a crafted DLL in a searched directory and run code with the application's privileges.
EPSS, a statistical model that estimates the likelihood of exploitation activity over the next 30 days, scored all six low at the time of writing, between roughly 0.002 and 0.012. The two signals measure different things: EPSS is a forecast, while a KEV entry reflects evidence CISA already holds. When they disagree, the KEV entry is the one to act on.
Update Plex, SiteGuard and Siemens Software Center now
Under Binding Operational Directive 22-01, US federal civilian agencies must remediate KEV entries by the due date CISA sets. Everyone else should treat the listing as a prioritization signal:
- Update Plex Media Server to the latest version and confirm against the vendor's guidance that all four CVEs are fixed in it.
- Apply the fixes EG Secure Solutions and Siemens have published for SiteGuard Server Edition and Software Center; the vendor advisories carry the fixed versions.
- Where an update cannot be applied quickly, follow the vendor's mitigations, or stop using the product if none are available, which is CISA's standard KEV instruction.
- Review who holds admin rights on Plex servers, since CISA's description of the highest-scored bug involves an admin user.
Earlier this month CISA also flagged years-old ProFTPD and Struts bugs as exploited. Media servers tend to live outside the normal patch cycle, which is exactly why a chain listed in one deserves attention today rather than at the next maintenance window.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.