CISA Adds Six Actively Exploited Vulnerabilities to KEV Catalog – Immediate Patch Required for Plex, EG Secure, Siemens
What It Is – CISA announced that six CVEs (CVE‑2026‑96652, CVE‑2026‑96654, CVE‑2026‑96655, CVE‑2026‑96656, CVE‑2026‑106931, CVE‑2026‑110936) have been confirmed as actively exploited and are now listed in the Known Exploited Vulnerabilities (KEV) Catalog.
Exploitability – All six vulnerabilities have evidence of real‑world exploitation; several are server‑side request forgery, OS command injection, and uncontrolled search‑path flaws that grant attackers total control of the affected service.
Affected Products – Plex Media Server (multiple SSRF and path‑traversal flaws), EG Secure Solutions SiteGuard Server Edition (OS command injection), Siemens Software Center (uncontrolled search‑path element).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a continuous vulnerability‑management control that maps to multiple frameworks (e.g., NIST CSF, ISO 27001) – one control objective covers patching, detection, and evidence collection.
- Provides a concrete audit‑ready signal: rapid remediation of KEV items can be captured as defensible evidence of due diligence.
- Highlights the importance of continuous control mapping to show stakeholders that known high‑risk flaws are being tracked, prioritized, and closed.
Recommended Actions
- Identify any public‑facing assets running the listed products and verify their version.
- Prioritize patching per CISA BOD 26‑04; apply vendor fixes or mitigations immediately.
- Record remediation steps in a centralized control‑evidence repository to support audit trails.
- Integrate KEV monitoring into your continuous vulnerability‑scanning pipeline.
- Review and update your vulnerability‑management policy to reference the KEV Catalog.
Source: CISA Advisory – 20 Oct 2026