// Summary
CISA added 50 CVEs to the Known Exploited Vulnerabilities (KEV) catalog across this reporting window, with the newest batch landing 2026-10-20 led by a root/SYSTEM-level OS command injection in EG Secure Solutions SiteGuard Server Edition. A four-CVE Plex Media Server exploit chain also entered KEV the same day. Nine previously-added CVEs — spanning BeyondTrust, Fortinet, Atlassian, Ahsay, Cisco, Palo Alto Networks, Ivanti, and Microsoft — now have BOD 26-04 remediation deadlines that have already passed as of today; agencies still unpatched are out of compliance.
| Total additions (this run) | 50 |
| Detailed below | 40 |
| Deadlines already lapsed | 9 |
| Due within 48 hours | 3 |
| Known ransomware use flagged | 0 (all marked "Unknown" in source) |
// Lead: Newest Additions (2026-10-20)
SiteGuard OS Command Injection
| ID | CVE-2026-106931 |
| Manufacturer | EG Secure Solutions |
| Product | SiteGuard Server Edition |
| Reason | OS command injection enabling arbitrary command execution with root/SYSTEM privileges |
| Due | 2026-10-23 |
Root/SYSTEM-level command execution with a 48-hour patch window — this is today's top priority for any organization running SiteGuard.
Plex Media Server Exploit Chain
| ID | CVE-2026-96656 (file path control), CVE-2026-96655 (SSRF via transcode endpoint), CVE-2026-96654 (encoded URI scheme neutralization), CVE-2026-96652 (SSRF via protocol parameter) |
| Manufacturer | Plex |
| Product | Media Server |
| Reason | Four chainable vulnerabilities allowing an admin user to write and execute arbitrary files, with SSRF enabling attacker-controlled POST requests |
| Due | CVE-2026-96656 and CVE-2026-96654 due 2026-10-23; CVE-2026-96655 and CVE-2026-96652 due 2026-11-03 |
CISA explicitly notes these four are chainable — treat as a single exploitation path rather than isolated bugs. Prioritize patching all four together.
Siemens Software Center DLL Hijack
| ID | CVE-2026-110936 |
| Manufacturer | Siemens |
| Product | Software Center |
| Reason | Uncontrolled search path element allows local DLL hijacking for code execution |
| Due | 2026-11-03 |
// Overdue: BOD 26-04 Deadlines Already Passed
These nine entries carried remediation deadlines on or before 2026-10-19 — federal stakeholders should confirm remediation status and document any exceptions immediately.
BeyondTrust Remote Support Auth Bypass
| ID | CVE-2026-102764 | Due: 2026-10-19 | Reason: Spoofing-based auth bypass enabling remote file operations on the appliance |
Fortinet Multiple Products Path Traversal
| ID | CVE-2025-61624 | Product: FortiOS, FortiPAM, FortiProxy, FortiSwitchManager | Due: 2026-10-19 |
Atlassian Multiple Products Exposure
| ID | CVE-2026-21589 | Product: Bitbucket, Confluence, Jira Service Management/Software, Bamboo, Crowd DC, Crucible, Fisheye | Due: 2026-10-18 |
Ahsay AhsayCBS Chain (Command Injection + Auth Bypass)
| ID | CVE-2026-105134, CVE-2026-105133 | Due: 2026-10-17 | Reason: Auth bypass chained with command injection via the Replication Receiver API |
Cisco Secure Email Gate
