Government Advisory

CISA Warns of Active Attacks on Plex Media Server and Other Software

CISA · 20 Oct 2026

Key Takeaway Check whether any of these products run in your business, patch them promptly, and use the KEV Catalog to decide which updates to tackle first.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after finding evidence of active exploitation. Four affect Plex Media Server: two server-side request forgery flaws (CVE-2026-96652 and CVE-2026-96655), one involving improper handling of encoded URI schemes (CVE-2026-96654), and one involving external control of a file name or path (CVE-2026-96656).

The other two affect EG Secure Solutions SiteGuard Server Edition, which has an OS command injection flaw (CVE-2026-106931), and Siemens Software Center, which has an uncontrolled search path element flaw (CVE-2026-110936). CISA notes that these types of vulnerabilities are a frequent attack vector for malicious cyber actors.

CISA's Binding Operational Directive 26-04 requires US federal agencies to prioritise rapid fixes for KEV-listed flaws on publicly exposed assets that give an attacker total control once exploited. It also sets expectations for checking whether a system was compromised before a patch was applied. The directive applies only to federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and prioritise fixing vulnerabilities in the KEV Catalog.

CISA KEV Plex Media Server Vulnerability Management Patching

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.