Exploited this week: 8 vulnerabilities added to CISA’s KEV list (19 Oct to 25 Oct 2026)

Automatic post. Built by KEH-TECH from CISA’s Known Exploited Vulnerabilities catalog, as read by the Patch Tuesday hub, and published without editing. The figures are the source’s own; follow the links for the full detail.

Between 19 October 2026 and 25 October 2026, CISA added 8 entries to its list of vulnerabilities being exploited in the wild. US federal agencies must fix these by the deadline shown; everyone else should treat that date as the latest sensible one.

Added this week

• CVE-2026-106931 EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability. Added 20 Oct; federal deadline 23 October 2026.
• CVE-2026-110936 Siemens Software Center Uncontrolled Search Path Element Vulnerability. Added 20 Oct; federal deadline 3 November 2026.
• CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. Added 20 Oct; federal deadline 3 November 2026.
• CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability. Added 20 Oct; federal deadline 23 October 2026.
• CVE-2026-96655 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability. Added 20 Oct; federal deadline 3 November 2026.
• CVE-2026-96656 Plex Media Server External Control of File Name or Path Vulnerability. Added 20 Oct; federal deadline 23 October 2026.
• CVE-2026-110447 Collabora Online – Built-in CODE Server OS Command Injection Vulnerability. Added 23 Oct; federal deadline 26 October 2026.
• CVE-2026-114625 Arista VeloCloud Orchestrator SQL Injection Vulnerability. Added 23 Oct; federal deadline 26 October 2026.

Running any of these? Each CVE’s vendor advisory has the fix or the workaround. Found one in your environment? The Patch Panel is the place to compare notes.