CISA Adds Six Known Exploited Vulnerabilities to Catalog

As cited

Copy frozen at 2026-10-20 21:40 UTC (site build).

vulnerabilities

CISA Adds Six Known Exploited Vulnerabilities to Catalog

CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 20, 2026, after confirming active exploitation. The affected products include Plex Media Server (four vulnerabilities spanning SSRF, path traversal, and URI neutralization flaws), EG Secure Solutions SiteGuard Server Edition, and Siemens Software Center. Binding Operational Directive 26-04 now requires U.S. federal agencies to prioritize patching high-risk KEV Catalog vulnerabilities on publicly exposed assets, with agencies also required to check for pre-patch compromise.

Why it matters: Federal agencies must treat these six CVEs as immediate priorities under BOD 26-04, and all organizations using Plex Media Server, SiteGuard Server Edition, or Siemens Software Center should assess exposure and patch urgently given confirmed active exploitation.

Source published

2026-10-20 12:00 UTC

First seen by Cybersecurity Tracker

2026-10-20 20:57 UTC