CISA Adds Six Known Exploited Vulnerabilities to Catalog

October 20, 2026 · 12:00 pm 3 sources

Image: CISA

Coverage

Wires & papers of record

• CISA Adds Six Known Exploited Vulnerabilities to Catalog
  CISA · October 20, 2026 12:00
  CISA has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-96652 Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability CVE-2026-96654 Plex Media Server Improper Neutralization of Encoded URI Schemes…

Coverage

• CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
  BleepingComputer · October 21, 2026 18:34
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. [...]

More coverage

• CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
  The Hacker News · October 21, 2026 07:26
  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below -…