Organizations should prioritize rapid remediation of these KEV Catalog vulnerabilities on publicly exposed assets. Specific patch guidance requires applying vendor-supplied updates for Plex Media Server, SiteGuard Server Edition, and Siemens Software Center. FCEB agencies must follow Binding Operational Directive 26-04 requirements for prioritizing security updates based on risk.
Quick answers
What is CVE-2026-96654?
Organizations should prioritize rapid remediation of these KEV Catalog vulnerabilities on publicly exposed assets. Specific patch guidance requires applying vendor-supplied updates for Plex Media Server, SiteGuard Server Edition, and Siemens Software Center. FCEB agencies must follow Binding Operational Directive 26-04 requirements for prioritizing security updates based on risk.
How severe is CVE-2026-96654?
high
Is CVE-2026-96654 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-96654 be mitigated?
Organizations should prioritize rapid remediation of these KEV Catalog vulnerabilities on publicly exposed assets. Specific patch guidance requires applying vendor-supplied updates for Plex Media Server, SiteGuard Server Edition, and Siemens Software Center. FCEB agencies must follow Binding Operational Directive 26-04 requirements for prioritizing security updates based on risk.
CVSS
—
Vendor
Plex
Published
Oct 21, 2026 · 01:14
Patch
Unknown / not confirmed
Affected products
Plex Media Server, SiteGuard Server Edition, Siemens Software Center
Mitigation
Organizations should prioritize rapid remediation of these KEV Catalog vulnerabilities on publicly exposed assets. Specific patch guidance requires applying vendor-supplied updates for Plex Media Server, SiteGuard Server Edition, and Siemens Software Center. FCEB agencies must follow Binding Operational Directive 26-04 requirements for prioritizing security updates based on risk.
On October 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Four of the newly listed flaws affect Plex Media Server, including two Server-Side Request Forgery (SSRF) vulnerabilities, an Improper Neutralization of Encoded URI Schemes issue, and an External Control of File Name or Path vulnerability. The remaining two CVEs target Siemens Software Center and EG Secure Solutions SiteGuard Server Edition, respectively. CISA emphasized that these vulnerabilities represent frequent attack vectors for malicious actors and pose significant risks to federal enterprise systems.