CISA KEV Flash: 9 CVEs Added — Plex Media Server, BeyondTrust & Fortinet Under Active Attack | Security Arsenal

CISA's Known Exploited Vulnerabilities catalog just absorbed nine new entries between October 15 and October 20, 2026 — and the composition of this batch should alarm every SOC lead reading this. Four of the nine CVEs target Plex Media Server, a product that sits in millions of home labs, small business environments, and — critically — an uncomfortable number of corporate networks where it was deployed without IT's knowledge. Add an authentication bypass in BeyondTrust Remote Support (a privileged access product) and a path traversal across the Fortinet product line (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager), and you have a batch that maps almost perfectly onto the initial-access playbook used by ransomware affiliates and IABs (initial access brokers) over the last three years.

Per CISA's Binding Operational Directive 22-01, federal civilian agencies face mandatory remediation deadlines (typically three weeks from KEV addition — meaning November 6, 2026 for the October 16 additions and November 10, 2026 for the October 20 additions). Private-sector organizations should treat these as the same severity. CISA does not add CVEs to the KEV on speculation — every entry below is confirmed exploited in the wild.

Active Exploitation Intelligence

CVE-2026-102764 — BeyondTrust Remote Support: Authentication Bypass by Spoofing

Added to KEV: 2026-10-16 | Ransomware linkage: Unknown (under analysis)
What it is: An authentication bypass by spoofing flaw that allows a remote, unauthenticated attacker to perform file operations on the appliance. BeyondTrust Remote Support (formerly Bomgar) brokers privileged remote sessions into enterprise environments — a compromise here is a compromise of the keys to the kingdom.
Exploitation method: Auth bypass → arbitrary file operations → likely webshell/credential theft → lateral movement into supported endpoints. This is the exact kill chain pattern we saw with CVE-2024-12356 (BeyondTrust RCE exploited against the U.S. Treasury in late 2024).
CVSS: Vendor scoring pending; Security Arsenal assesses 9.8 (Critical) given unauthenticated remote exploitation of a PAM-class product.
PoC status: No public PoC confirmed at time of writing, but exploitation is confirmed — assume working exploit code circulates in private channels.
CISA required action: Apply vendor mitigations per advisory; discontinue use if mitigations unavailable. Deadline: 2026-11-06.
Threat actor assessment: PAM/remote-support appliances are disproportionately targeted by ransomware operators seeking domain-wide access. Watch for affiliate groups historically associated with BeyondTrust/Bomgar targeting.

CVE-2025-61624 — Fortinet Multiple Products: Path Traversal

Added to KEV: 2026-10-16 | Ransomware linkage: Unknown
What it is: A path traversal vulnerability in FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that may allow an authenticated attacker to access or manipulate files outside the intended path.
Exploitation method: Authenticated path traversal → config file read/credential extraction → persistence. Note the "authenticated" qualifier reduces severity only marginally: Fortinet admin interfaces are routinely accessed via credential stuffing against SSL-VPN and management portals.
CVSS: Pending NVD enrichment; assess 7.5–8.5 (High to Critical) depending on reachable file scope.
PoC status: No confirmed public PoC; exploitation in the wild confirmed by CISA.
CISA required action: Patch per Fortinet advisory. Deadline: 2026-11-06.
Threat actor assessment: Fortinet edge devices remain the single most exploited vendor class in KEV history — routinely abused by APTs (Volt Typhoon-adjacent clusters) and ransomware ops (historically linked to groups like Black Basta and Akira affiliates). Treat any Fortinet KEV addition as top priority.

The Plex Media Server Cluster — CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656

All four were added 2026-10-20, strongly suggesting a coordinated exploitation campaign — likely a single threat actor or botnet operator chaining these flaws against internet-exposed Plex instances.

CVE-2026-96652 (SSRF, highest priority of the four): SSRF exploitable using any X-Plex-Token value — effectively a near-unauthenticated attack primitive. Attackers can coerce the server into making arbitrary internal requests, enabling cloud-metadata theft (169.254.169.254), internal service enumeration, and pivot into flat networks. Assess CVSS 8.6–9.1. This is the most dangerous of the Plex cluster because token validation is the flaw itself.
CVE-2026-96656 (Arbitrary File Write): External control of file name/path allowing an admin user to write arbitrary files. Chained with any auth weakness (or CVE-2026-96652 token abuse), this becomes full RCE via writing to plugin directories, scheduled task configs, or web root. Assess CVSS 8.8+ when chained.
CVE-2026-96655 (SSRF, authenticated): Authenticated SSRF allowing arbitrary internal requests. Lower barrier than it appears — Plex tokens leak constantly via client logs, DLNA integrations, and third-party "request" front-ends (Overseerr/Ombii ecosystems).
CVE-2026-96654 (Encoded URI scheme neutralization): Improper neutralization of encoded URI schemes in web pages, allowing an attacker to call arbitrary handlers — a client-side vector useful for phishing/token theft against Plex Web users, feeding the other three CVEs.
Exploitation method (combined): Token-agnostic SSRF (96652) → internal recon → file write (96656) → RCE/persistence; 96654 used for token harvesting to unlock 96655/96656.
PoC status: No confirmed public PoCs, but four same-day KEV additions indicate a mature exploit chain already operational.
CISA required action: Apply Plex updates immediately. Deadline: 2026-11-10.
Threat actor assessment: Plex has ~20M+ users; exposed instances are scanned relentlessly. Expect botnet operators (Mirai-derivative and proxyware crews) and crypto-mining groups first, ransomware affiliates second — Plex servers are frequently on the same LAN as backup NAS devices.

CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition: OS Command Injection

Added to KEV: 2026-10-20 | Ransomware linkage: Unknown
What it is: OS command injection allowing an attacker to execute arbitrary commands. SiteGuard is a Japanese-market web server security/WAF-adjacent product — meaning the security control itself is the intrusion vector.
Exploitation method: Command injection → direct RCE on the management server. Security products hold elevated network trust; compromise enables traffic inspection bypass and lateral movement.
CVSS: Assess 9.8 (Critical) pending official scoring.
PoC status: Not public; exploitation confirmed.
CISA required action: Vendor mitigation/patch. Deadline: 2026-11-10.

CVE-2026-110936 — Siemens Software Center: Uncontrolled Search Path Element

Added to KEV: 2026-10-20 | Ransomware linkage: Unknown
What it is: DLL-hijack-class flaw allowing an authenticated local attacker to place malicious libraries in the search path — local privilege escalation (LPE) on engineering workstations.
Exploitation method: Post-compromise LPE. This CVE won't be your initial access — it's the second stage on OT/ICS engineering stations after phishing or the BeyondTrust/Fortinet footholds above.
CVSS: Assess 7.8 (High) — local, but on ICS workstations where privilege escalation has outsized impact.
CISA required action: Patch per Siemens advisory. Deadline: 2026-11-10.

CVE-2026-21589 — Atlassian Multiple Products (Bitbucket DC, Confluence DC, Jira Service Management DC, Jira Software DC)

Added to KEV: 2026-10-15 | Ransomware linkage: Unknown
What it is: A cross-product vulnerability affecting four Atlassian Data Center platforms (full description truncated in feed; treat as remotely exploitable pending vendor detail). Atlassian DC products hold source code, internal documentation, and service-desk credentials — prime espionage and ransomware staging targets.
Exploitation method: Atlassian's KEV history (CVE-2023-22515, CVE-2022-26134) shows mass scanning within 24–48 hours of disclosure, with webshell deployment (Behinder/Godzilla) as the standard payload.
CISA required action: Apply Atlassian patches. Deadline: 2026-11-05 (earliest in this batch — check your exposure today).

Affected Organizations Assessment

Who is exposed:

Plex cluster: SMBs, media/production firms, education, and any enterprise with shadow-IT Plex instances on flat networks. Plex's own breach history (2022 forum breach) proves its install base gets enumerated. Internet-exposed Plex (default port 32400) is trivially discoverable via Shodan — historically 300,000+ instances are publicly indexed at any time.
BeyondTrust Remote Support: Enterprise service desks, MSPs, healthcare, government. MSP deployment means one vulnerable appliance = dozens of downstream client networks.
Fortinet: Universal — FortiGate/FortiOS holds roughly a third of the enterprise firewall market. FortiPAM exposure concentrates in finance and critical infrastructure.
Atlassian DC: Software engineering organizations, tech, finance, defense contractors. Self-hosted Data Center instances patch slowly — historical data shows 40–60% of DC instances remain unpatched 30 days after critical advisories.
Siemens Software Center: Manufacturing, energy, industrial automation — OT environments where patching windows are quarterly at best.
SiteGuard: Organizations with Japanese infrastructure or APAC data centers using EG Secure Solutions products.

Sector exploitation velocity (historical pattern):

Fastest: Edge/VPN/firewall vendors (Fortinet) — scanning within hours, exploitation by both APTs and ransomware affiliates.
Fast: Remote access/PAM (BeyondTrust) — targeted rather than sprayed; high-value intrusions.
Fast: Atlassian — mass automated exploitation within 48 hours of public detail.
Moderate but dangerous: Consumer/media software (Plex) — botnet-driven, opportunistic, but high LAN-pivot value.
Slow-burn: OT-adjacent LPE (Siemens) — weaponized in deliberate intrusions, not mass campaigns.

Detection Engineering

Sigma Rules

YAML

---
title: Plex Media Server Suspicious Token Usage and SSRF Indicators
id: 8f3a2b1c-9e10-4a01-b201-plex96652ssrf
status: experimental
description: Detects exploitation patterns associated with CVE-2026-96652 / CVE-2026-96655 — Plex SSRF via X-Plex-Token abuse, including requests to cloud metadata and internal services
author: Security Arsenal Threat Intel
date: 2026/10/20
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: webserver
  product: plex
detection:
  selection_token:
    - 'X-Plex-Token'
  selection_internal_targets:
    cs-uri-query|contains:
      - '169.254.169.254'
      - 'metadata.google.internal'
      - '127.0.0.1'
      - 'localhost'
      - '192.168.'
      - '10.0.'
      - '172.16.'
  condition: selection_token and selection_internal_targets
falsepositives:
  - Legitimate local Plex clients on loopback
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.96652
  - cve.2026.96655
---
title: BeyondTrust Remote Support Anomalous File Operations
id: 7c2b9d4e-1027-4b02-a302-btrs102764ab
status: experimental
description: Detects unauthenticated file operation attempts on BeyondTrust Remote Support appliances consistent with CVE-2026-102764 authentication bypass exploitation
author: Security Arsenal Threat Intel
date: 2026/10/20
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/get_file'
      - '/download'
      - '/api/'
      - '/nw/'
  selection_unauth:
    sc-status:
      - 200
    cs-username:
      - ''
      - '-'
  filter_product:
    cs-host|contains:
      - 'beyondtrust'
      - 'bomgar'
      - 'remotesupport'
  condition: selection_path and selection_unauth and filter_product
falsepositives:
  - Unauthenticated health-check endpoints; baseline appliance URL structure first
level: critical
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1190
  - cve.2026.102764
---
title: Fortinet Management Interface Path Traversal Attempt
id: 5d1e8f3a-2158-4c03-b403-forti61624pt
status: experimental
description: Detects path traversal sequences in requests to FortiOS, FortiPAM, FortiProxy, or FortiSwitchManager management interfaces consistent with CVE-2025-61624 exploitation
author: Security Arsenal Threat Intel
date: 2026/10/20
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: webserver
detection:
  selection_traversal:
    cs-uri-stem|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%2f'
      - '%252e%252e'
  selection_forti:
    cs-uri-stem|contains:
      - '/api/v2/'
      - '/fortipam/'
      - '/fgt/'
      - '/switch-manager/'
      - '/fortiproxy/'
  condition: selection_traversal and selection_forti
falsepositives:
  - Rare; URL-encoded traversal in management API requests is not legitimate behavior
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.61624

KQL (Microsoft Sentinel) — Hunt Query

KQL — Microsoft Sentinel / Defender

// KEV Wave 2026-10-15..20: Hunt for exploitation indicators across Plex, BeyondTrust, Fortinet, Atlassian
// Deploy against web/proxy logs (CommonSecurityLog, W3CIISLog, or custom ingestion) and endpoint telemetry
let KEVWindowStart = datetime(2026-10-10);
let SuspiciousTraversal = dynamic(["../", "%2e%2e", "..%2f", "%252e%252e"]);
let MetadataTargets = dynamic(["169.254.169.254", "metadata.google.internal", "100.100.100.200"]);
let WebTraffic = union isfuzzy=true
    (CommonSecurityLog
     | where TimeGenerated > KEVWindowStart
     | extend Uri = coalesce(RequestURL, DestinationHostName, ""),
              SrcIP = SourceIP, Method = RequestMethod, Status = "",
              Headers = AdditionalExtensions),
    (W3CIISLog
     | where TimeGenerated > KEVWindowStart
     | extend Uri = strcat(csUriStem, "?", csUriQuery),
              SrcIP = cIP, Method = csMethod, Status = tostring(scStatus),
              Headers = csUserAgent));
WebTraffic
| extend Indicator = case(
    Uri has_any (MetadataTargets) and Headers has "X-Plex-Token", "Plex SSRF (CVE-2026-96652/96655)",
    Uri has "32400" and Uri has_any (MetadataTargets), "Plex SSRF (CVE-2026-96652/96655)",
    Uri has_any (SuspiciousTraversal) and Uri has_any ("/api/v2/", "/fortipam/", "/fortiproxy/", "/switch-manager/"), "Fortinet Path Traversal (CVE-2025-61624)",
    Uri has_any ("/get_file", "/download") and isempty(Status) == false and Headers has_any ("beyondtrust", "bomgar"), "BeyondTrust File Op (CVE-2026-102764)",
    Uri has_any ("/rest/api/", "/confluence/", "/bitbucket/") and Uri has_any (SuspiciousTraversal), "Atlassian DC Traversal (CVE-2026-21589)",
    "")
| where Indicator != ""
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Attempts = count(), UniqueURIs = dcount(Uri),
            SampleURIs = make_set(Uri, 5)
    by Indicator, SrcIP, bin(TimeGenerated, 1h)
| order by Attempts desc;
// Endpoint follow-up: child processes spawned by media server / security product binaries
DeviceProcessEvents
| where TimeGenerated > KEVWindowStart
| where InitiatingProcessFileName has_any ("Plex Media Server.exe", "PlexScriptHost.exe", "java.exe", "httpd.exe", "nginx.exe", "bomgar", "siteguard")
| where FileName has_any ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl.exe", "wget.exe", "certutil.exe", "mshta.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

Remediation & Inventory Script (PowerShell)

PowerShell

<#
.SYNOPSIS
  Security Arsenal — KEV Wave 2026-10-15..20 Exposure Inventory & Validation
  Checks for vulnerable: Plex Media Server, BeyondTrust RS client footprint,
  Atlassian DC products, Siemens Software Center, Fortinet management reachability.
  Run elevated. Outputs CSV for remediation tracking.
#>

$ErrorActionPreference = 'SilentlyContinue'
$report = @()
$outCsv = ".\KEV_2026-10_Wave_Inventory_$(Get-Date -Format 'yyyyMMdd_HHmm').csv"

function Add-Finding($Product, $CVE, $Version, $Path, $Vulnerable, $Note) {
    $script:report += [pscustomobject]@{
        Hostname   = $env:COMPUTERNAME
        Product    = $Product
        CVE        = $CVE
        Version    = $Version
        Path       = $Path
        Vulnerable = $Vulnerable
        Note       = $Note
        CheckedAt  = (Get-Date)
    }
}

# --- 1) Plex Media Server (CVE-2026-96652/96654/96655/96656) ---
# Action: update to the latest Plex release per https://www.plex.tv/media-server-downloads/
$plexExe = "$env:ProgramFiles\Plex\Plex Media Server\Plex Media Server.exe"
if (-not (Test-Path $plexExe)) { $plexExe = "${env:ProgramFiles(x86)}\Plex\Plex Media Server\Plex Media Server.exe" }
if (Test-Path $plexExe) {
    $v = (Get-Item $plexExe).VersionInfo.ProductVersion
    # Any instance present during an active-exploitation window is treated as exposed until patched.
    Add-Finding 'Plex Media Server' 'CVE-2026-96652/96654/96655/96656' $v $plexExe 'YES' 'Patch immediately; restrict port 32400 from internet; rotate X-Plex-Tokens'
    # Check internet exposure via firewall rules
    $fw = Get-NetFirewallRule -DisplayName '*plex*' | Where-Object {$_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound'}
    if ($fw) { Add-Finding 'Plex Media Server' 'EXPOSURE' $v 'Firewall' 'YES' 'Inbound firewall rules permit Plex traffic — verify no NAT port-forward on edge device' }
}

# --- 2) Atlassian Data Center products (CVE-2026-21589) ---
# Action: apply Atlassian patches per https://confluence.atlassian.com/security/
$atlassianPaths = @(
    "$env:ProgramFiles\Atlassian\Confluence",
    "$env:ProgramFiles\Atlassian\JIRA",
    "$env:ProgramFiles\Atlassian\Bitbucket",
    "C:\Atlassian"
)
foreach ($p in $atlassianPaths) {
    if (Test-Path $p) {
        Add-Finding 'Atlassian Data Center' 'CVE-2026-21589' 'See build number' $p 'LIKELY' 'Verify build against Atlassian security advisory fixed versions; patch or restrict to VPN-only'
    }
}

# --- 3) Siemens Software Center (CVE-2026-110936) ---
# Action: update per Siemens ProductCERT advisory; audit DLL search-path directories for write access
$sscPaths = @("$env:ProgramFiles\Siemens\Software Center", "${env:ProgramFiles(x86)}\Siemens\Software Center")
foreach ($p in $sscPaths) {
    if (Test-Path $p) {
        $acl = Get-Acl $p
        $worldWritable = $acl.Access | Where-Object { $_.IdentityReference -match 'Users|Everyone' -and $_.FileSystemRights -match 'Write|Modify|FullControl' }
        Add-Finding 'Siemens Software Center' 'CVE-2026-110936' 'Unknown' $p ($null -ne $worldWritable) 'Uncontrolled search path: restrict directory ACLs to Administrators; update Software Center'
        if ($worldWritable) {
            Write-Warning "[Siemens] $p is writable by standard users — remediating ACL (backup first!)"
            # Uncomment to enforce remediation after change approval:
            # $acl.SetAccessRuleProtection($true,$true)
            # $acl.Access | Where-Object {$_.IdentityReference -match 'Users'} | ForEach-Object { $acl.RemoveAccessRule($_) | Out-Null }
            # Set-Acl $p $acl
        }
    }
}

# --- 4) BeyondTrust Remote Support footprint (CVE-2026-102764) ---
# Action: patch appliance per BeyondTrust advisory https://www.beyondtrust.com/trust-center/security-advisories
$btSvc = Get-Service | Where-Object { $_.DisplayName -match 'BeyondTrust|Bomgar' }
if ($btSvc) {
    Add-Finding 'BeyondTrust Remote Support (client/host)' 'CVE-2026-102764' 'See appliance' ($btSvc | Select-Object -First 1).DisplayName 'CHECK' 'Endpoint client present — confirm the APPLIANCE itself is patched; this is where the auth bypass lives'
}
# Network reachability check to internal BeyondTrust portal (edit FQDN)
$btPortal = 'support.yourdomain.example'
if (Test-Connection $btPortal -Count 1 -Quiet) {
    try {
        $r = Invoke-WebRequest -Uri "https://$btPortal/api/version" -UseBasicParsing -TimeoutSec 8
        Add-Finding 'BeyondTrust Appliance' 'CVE-2026-102764' $r.Content $btPortal 'CHECK' 'Compare version against BeyondTrust fixed release; restrict management interface to allowlist'
    } catch { Add-Finding 'BeyondTrust Appliance' 'CVE-2026-102764' 'unreachable-version' $btPortal 'CHECK' 'Manually verify appliance patch level in admin console' }
}

# --- 5) Fortinet management interfaces (CVE-2025-61624) — from a jump host ---
# Action: patch per Fortinet PSIRT https://www.fortiguard.com/psirt
$fortiTargets = @('fortigate.yourdomain.example')  # Edit: add FortiPAM/FortiProxy/FortiSwitchManager FQDNs
foreach ($t in $fortiTargets) {
    if (Test-Connection $t -Count 1 -Quiet) {
        try {
            $r = Invoke-WebRequest -Uri "https://$t/api/v2/monitor/system/status" -UseBasicParsing -TimeoutSec 8 -SkipCertificateCheck
            Add-Finding 'Fortinet Device' 'CVE-2025-61624' $r.Content $t 'CHECK' 'Verify firmware against Fortinet advisory; disable management access from WAN; audit admin accounts'
        } catch { Add-Finding 'Fortinet Device' 'CVE-2025-61624' 'auth-required' $t 'CHECK' 'Login to device and confirm firmware version against PSIRT fixed builds' }
    }
}

# --- Validation & Output ---
$report | Format-Table -AutoSize
$report | Export-Csv -NoTypeInformation -Path $outCsv
Write-Host "`nInventory complete: $outCsv" -ForegroundColor Cyan
Write-Host "Validation step: after patching, re-run this script — 'Vulnerable=YES' rows must drop to zero." -ForegroundColor Yellow
Write-Host "CISA BOD 22-01 deadlines: CVE-2026-21589 -> 2026-11-05 | CVE-2026-102764 & CVE-2025-61624 -> 2026-11-06 | All 2026-10-20 additions -> 2026-11-10" -ForegroundColor Yellow

Patch & Remediation Priorities

Priority 1 — Patch within 24 hours (edge/PAM, unauthenticated or near-unauthenticated)

CVE-2026-102764 — BeyondTrust Remote Support. Apply the vendor hotfix per the BeyondTrust Trust Center security advisory (https://www.beyondtrust.com/trust-center/security-advisories). Workaround if patching is delayed: restrict appliance web interface to an IP allowlist, disable external portal access, and audit session logs for file-operation anomalies. CISA deadline: 2026-11-06.
CVE-2025-61624 — Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager. Upgrade per Fortinet PSIRT advisory (https://www.fortiguard.com/psirt). Workarounds: disable management interfaces on WAN-facing ports, enforce admin MFA, audit for unauthorized admin accounts and recently modified configuration files. CISA deadline: 2026-11-06.
CVE-2026-96652 — Plex SSRF (any-token bypass). Update Plex Media Server via https://www.plex.tv/media-server-downloads/ (auto-update: Settings → Server → General). Workarounds: remove internet exposure of port 32400, place Plex behind authenticated reverse proxy, rotate all Plex tokens (sign out all devices via plex.tv account settings). CISA deadline: 2026-11-10.

Priority 2 — Patch within 72 hours

CVE-2026-21589 — Atlassian DC products. Apply fixed versions per https://confluence.atlassian.com/security/ for Confluence, Jira Software, Jira Service Management, and Bitbucket Data Center. Workaround: VPN-only access, WAF rules blocking traversal sequences in /rest/ paths, and webshell hunting (check for unexpected .jsp/.class files in application directories). CISA deadline: 2026-11-05 — earliest in this batch.
CVE-2026-96656 / 96655 / 96654 — remaining Plex CVEs. Same patch action as #3 — one update covers the cluster.

Priority 3 — Patch within the maintenance window (this week)

CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition. Apply vendor update; workaround: isolate SiteGuard management interfaces, review web logs for command-injection patterns (;, |, backticks in parameters). CISA deadline: 2026-11-10.
CVE-2026-110936 — Siemens Software Center. Update per Siemens ProductCERT advisory (https://cert-portal.siemens.com/). Workaround: lock down installation directory ACLs (remove Users write/modify), enable DLL search-path hardening (SafeDllSearchMode), and audit for unexpected DLLs adjacent to the Software Center binary. CISA deadline: 2026-11-10.

Universal compensating controls while patching

Block egress to cloud metadata endpoints (169.254.169.254) from servers that have no legitimate need.
Alert on any media server, remote-support, or security-appliance process spawning shells or download utilities.
Assume pre-patch compromise for any internet-exposed instance of the Priority 1 products: hunt back to October 10, 2026 before declaring clean.

The pattern in this batch is unmistakable: attackers are targeting the infrastructure that grants access to everything else — the remote-support appliance, the firewall, the security product. Patch the keys before you patch the doors.

Related Resources

Security Arsenal Penetration Testing Managed SOC & MDR AlertMonitor Platform From The Dark Side Intel Hub

CISA KEV Flash: 9 CVEs Added — Plex Media Server, BeyondTrust & Fortinet Under Active Attack