CISA Adds Six New Vulnerabilities to Known Exploited Vulnerabilities Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) announced the addition of six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 20, 2026, based on evidence of active exploitation. The newly listed CVEs are: CVE-2026-96652 and CVE-2026-96655, both Plex Media Server Server-Side Request Forgery (SSRF) vulnerabilities; CVE-2026-96654, a Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page vulnerability; CVE-2026-96656, a Plex Media Server External Control of File Name or Path vulnerability; CVE-2026-106931, an EG Secure Solutions SiteGuard Server Edition OS Command Injection vulnerability; and CVE-2026-110936, a Siemens Software Center Uncontrolled Search Path Element vulnerability.

CISA noted that these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. The agency highlighted that Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies, requiring them to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation. While BOD 26-04 applies only to FCEB agencies, CISA encouraged all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.

CISA also noted that organizations aware of an exploited vulnerability not currently listed in the KEV Catalog can submit it for potential addition through CISA's KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.