CISA Adds Six Known Exploited Vulnerabilities to Catalog
Summary
CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. These vulnerabilities affect Plex Media Server, EG Secure Solutions SiteGuard Server Edition, and Siemens Software Center. The additions are tied to Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize remediation of high-risk, exploited vulnerabilities.
IFF Assessment
The addition of exploited vulnerabilities to CISA's KEV catalog indicates active threats that defenders must address, posing a risk to organizational security.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 23, 2026. Known ransomware use: Unknown.
Defender Context
This alert is critical for defenders as it highlights specific vulnerabilities actively being exploited in the wild, requiring immediate attention for patching and mitigation. Organizations, particularly federal agencies, must adhere to risk-based vulnerability management and prioritize these KEV catalog entries to reduce their attack surface against known threats.