CISA adds six flaws to the KEV catalog: Plex2Shell chain, SiteGuard and Siemens Software Center

CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog on October 20, 2026, on evidence of active exploitation. The additions are the four Plex Media Server flaws in the Plex2Shell chain, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, with a federal remediation deadline of October 23, 2026; EG Secure Solutions SiteGuard Server Edition OS command injection, CVE-2026-106931, also with an October 23 deadline; and Siemens Software Center uncontrolled search path, CVE-2026-110936, with a November 3, 2026 deadline. The catalog count moves from the 1,748 entries verified earlier on October 20 by the six additions.

The SiteGuard flaw, in the statistics feature enabled by default, can let an attacker run OS commands with root or SYSTEM privileges, and is fixed in version 8.00 Update 5 (7.00 Update 6 on FreeBSD). The Siemens flaw lets an authenticated local attacker place a crafted DLL in a directory the application searches, leading to code execution with the privileges of the application; Siemens fixed it in version 4.0.9.8 and published advisory SSA-580366. The Plex2Shell exploitation itself was reported earlier on October 20 in a separate item on this page; this item records the new KEV listing for that chain and for the SiteGuard and Siemens flaws, which had previously been held on this page for lack of a KEV listing.

Sources: CISA; The Circuitry, SiteGuard; The Circuitry, Siemens