Selected reporting from trusted security teams, translated into why it matters and what defenders can do next.
Live source reporting, refreshed at most once per hour.
CISA KEV · VulnerabilityOct 23, 2026
CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
CVE-2026-110447CollaboraCollabora Online – Built-in CODE Server
Brief overview
CISA added this Collabora Collabora Online – Built-in CODE Server issue to the Known Exploited Vulnerabilities catalogue on Oct 23, 2026, which means there is evidence of exploitation in the wild. CISA lists Oct 26, 2026 as the remediation deadline for US federal civilian agencies; other organizations can use that date as an urgency signal rather than a universal compliance deadline.
Defender next steps
•Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
•Identify Collabora Collabora Online – Built-in CODE Server deployments, prioritize internet-facing and high-value systems, and check available telemetry for exploitation before closing the item.
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data…
CVE-2026-114625AristaVeloCloud Orchestrator
Brief overview
CISA added this Arista VeloCloud Orchestrator issue to the Known Exploited Vulnerabilities catalogue on Oct 23, 2026, which means there is evidence of exploitation in the wild. CISA lists Oct 26, 2026 as the remediation deadline for US federal civilian agencies; other organizations can use that date as an urgency signal rather than a universal compliance deadline.
Defender next steps
•Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
•Identify Arista VeloCloud Orchestrator deployments, prioritize internet-facing and high-value systems, and check available telemetry for exploitation before closing the item.
CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
CVE-2026-106931EG Secure SolutionsSiteGuard Server Edition
Brief overview
CISA added this EG Secure Solutions SiteGuard Server Edition issue to the Known Exploited Vulnerabilities catalogue on Oct 20, 2026, which means there is evidence of exploitation in the wild. CISA lists Oct 23, 2026 as the remediation deadline for US federal civilian agencies; other organizations can use that date as an urgency signal rather than a universal compliance deadline.
Defender next steps
•Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
•Identify EG Secure Solutions SiteGuard Server Edition deployments, prioritize internet-facing and high-value systems, and check available telemetry for exploitation before closing the item.
CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
CVE-2026-96654PlexMedia Server
Brief overview
CISA added this Plex Media Server issue to the Known Exploited Vulnerabilities catalogue on Oct 20, 2026, which means there is evidence of exploitation in the wild. CISA lists Oct 23, 2026 as the remediation deadline for US federal civilian agencies; other organizations can use that date as an urgency signal rather than a universal compliance deadline.
Defender next steps
•Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
•Identify Plex Media Server deployments, prioritize internet-facing and high-value systems, and check available telemetry for exploitation before closing the item.
CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
CVE-2026-96656PlexMedia Server
Brief overview
CISA added this Plex Media Server issue to the Known Exploited Vulnerabilities catalogue on Oct 20, 2026, which means there is evidence of exploitation in the wild. CISA lists Oct 23, 2026 as the remediation deadline for US federal civilian agencies; other organizations can use that date as an urgency signal rather than a universal compliance deadline.
Defender next steps
•Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
•Identify Plex Media Server deployments, prioritize internet-facing and high-value systems, and check available telemetry for exploitation before closing the item.
CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
CVE-2026-110936SiemensSoftware Center
Brief overview
CISA added this Siemens Software Center issue to the Known Exploited Vulnerabilities catalogue on Oct 20, 2026, which means there is evidence of exploitation in the wild. CISA lists Nov 3, 2026 as the remediation deadline for US federal civilian agencies; other organizations can use that date as an urgency signal rather than a universal compliance deadline.
Defender next steps
•Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
•Identify Siemens Software Center deployments, prioritize internet-facing and high-value systems, and check available telemetry for exploitation before closing the item.