What to patch now — 26 October 2026
Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.
A quieter week than last week's nine, but a wider spread of products. CISA added eight entries since the last edition (19 October). Four of those eight are the same chained vulnerability in one product (Plex Media Server), covered together below, leaving five write-ups. None are yet flagged by CISA as linked to a known ransomware campaign.
1. SiteGuard Server Edition — a built-in feature can be hijacked to run commands with full control of the server (CVE-2026-106931)
🛠️ EG Secure Solutions SiteGuard Server Edition · added 20 Oct 2026 · CISA fix-by date 23 Oct 2026 (3 days overdue)
What it is: SiteGuard Server Edition is a "web application firewall" (WAF) — software installed directly on a web server to filter out malicious requests before they reach the website's own code, rather than needing separate hardware. This is an "OS command injection" flaw: the product's built-in statistics feature, switched on by default, can be tricked into running operating-system-level commands, and the attacker gets them run with the highest level of access the server has (what's called "root" on Linux, "SYSTEM" on Windows) — effectively full control of the machine the website runs on.
Who's affected: Businesses running SiteGuard Server Edition on their own web server — a WAF product used mostly, though not only, by sites hosted with Japanese providers. If the name is unfamiliar, this almost certainly isn't something you run, but it's worth a quick check with whoever manages your website's hosting.
What to do: If you do run it, apply the vendor's fix (or disable the statistics feature if a patch isn't available yet) immediately — this one has been overdue against CISA's deadline for three days.
2. Plex Media Server — four flaws chain together into running an attacker's own code on the server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656)
🛠️ Plex Media Server · added 20 Oct 2026 · CISA fix-by dates 23 Oct 2026 (3 days overdue) and 3 Nov 2026, depending on the flaw
What it is: Plex Media Server is software many households and some small businesses run to store and stream their own video, music and photo collections to phones, TVs and laptops — often left reachable from outside the building so people can watch away from home or the office. CISA grouped four separate flaws in it together because, chained in sequence, they let someone holding any valid access token make the server fetch requests on the attacker's behalf, smuggle in disguised links, call hidden plugin functions, and ultimately write and run their own files on the machine. None of the four needs a full admin password on its own; together they add up to running code on the server.
Who's affected: Anyone running Plex Media Server that's reachable from the internet — including on a personal device connected to the same network as work systems, which is the detail that turns a "home media" problem into a business one.
What to do: Update Plex Media Server to the current version now — one update closes all four at once. If it runs on a device that also touches your business network, this is also a prompt to put it on its own separate network if you can.
3. Siemens Software Center — a logged-in user can trick it into loading a fake file and running their own code (CVE-2026-110936)
🛠️ Siemens Software Center · added 20 Oct 2026 · CISA fix-by date 3 Nov 2026 (not yet due)
What it is: Siemens Software Center is a tool used to install and manage Siemens industrial and engineering software on a PC. This is an "uncontrolled search path" flaw: when the program looks for a supporting file it needs in order to run, it can be tricked into loading a fake one planted by an attacker instead, letting that attacker's code run with whatever permissions the program has. It needs someone already logged into the machine, which limits it to an insider or a device already compromised some other way.
Who's affected: Manufacturers and engineering firms running Siemens industrial software managed through Software Center — not something a typical office-based small business would have installed.
What to do: If you or an engineering/OT provider runs Siemens Software Center, apply the fix; it's also a reminder that any shared or workshop PC used to manage industrial software should restrict who can log into it.
4. Arista VeloCloud Orchestrator — a remote attacker can manipulate the database behind your network's management console (CVE-2026-114625)
🛠️ Arista VeloCloud Orchestrator · added 23 Oct 2026 · CISA fix-by date 26 Oct 2026 (due today)
What it is: VeloCloud Orchestrator is the central management console for Arista's SD-WAN — the system that lets a business with several sites (shops, warehouses, branch offices) route and manage their network connections from one place, usually set up by a network or telecoms provider. "SQL injection" means a crafted request can trick the orchestrator's database into running the attacker's own instructions instead of the ones it was sent, from across the network with no login needed — exploited, it could let someone read, change or disrupt the data and settings controlling every site the orchestrator manages.
Who's affected: Businesses with multiple locations whose network runs on Arista SD-WAN — typically arranged and managed by a network provider on the business's behalf.
What to do: Ask your network or telecoms provider whether they run VeloCloud Orchestrator and whether today's fix-by deadline has been met — this one reaches every site the orchestrator manages, not just one.
5. Collabora Online's built-in document editor (inside Nextcloud) — an attacker can run their own commands on the server (CVE-2026-110447)
🛠️ Collabora Online – Built-in CODE Server (within Nextcloud) · added 23 Oct 2026 · CISA fix-by date 26 Oct 2026 (due today)
What it is: Nextcloud is self-hosted file-storage and office software some small businesses run as their own alternative to Google Workspace or Microsoft 365, and Collabora Online is the built-in tool that lets people edit documents, spreadsheets and presentations inside it. This is an "OS command injection" flaw in the component that does the actual document editing (the CODE server) — it's exploitable specifically when that component isn't running, and lets an attacker run their own commands on the underlying server as a result.
Who's affected: Businesses self-hosting Nextcloud with its built-in Collabora document editor, rather than using a cloud office suite — most likely those running their own server or a privacy-conscious IT setup.
What to do: If you self-host Nextcloud with Collabora's built-in editor, apply the fix today — it's due against CISA's deadline right now. If your documents live in a cloud office suite instead, this doesn't reach you.
This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.