Audience: Vulnerability Managers, Security Operations, CISOs, DevSecOps Teams
Reading Time: Approximately 10 minutes

Subscribe to get these articles directly to your inbox when published

This Week's KEV Additions

Note: EPSS scores are as published by FIRST.org at time of writing and are not updated after publication; scores change daily.

Analysis

CVE-2026-11462 — Arista VeloCloud Orchestrator (on-prem)

• What it is: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host.

• Affected versions: All vulnerable on-premise Arista VeloCloud Orchestrator versions prior to vendor fix.

• Exploitation status: Confirmed exploited in the wild, triggering CISA KEV catalog addition.

• Patch available: Yes, review Arista security advisory for official updates.

• CISA due date: 2026-11-13

• Operational risk: Potential compromise of the management plane, database layer access, and underlying host infrastructure for software-defined wide area network deployments.

CVE-2026-11044 — Collabora Online – Built-in CODE Server (NextCloud)

• What it is: Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution.

• Affected versions: Vulnerable configurations of Collabora Online Built-in CODE Server within NextCloud.

• Exploitation status: Active exploitation observed in the wild.

• Patch available: Yes, update CODE server component and NextCloud integration packages.

• CISA due date: 2026-11-13

• Operational risk: Remote code execution on collaboration servers housing sensitive enterprise documents and internal communications.

CVE-2026-10693 — EG Secure Solutions SiteGuard Server Edition

• What it is: EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges.

• Affected versions: Unpatched EG Secure Solutions SiteGuard Server Edition releases.

• Exploitation status: Exploited actively in real-world attacks.

• Patch available: Yes, consult vendor advisory for remediation.

• CISA due date: 2026-11-10

• Operational risk: Full root or SYSTEM level compromise of the underlying server infrastructure hosting the security solution.

CVE-2026-96656 — Plex Media Server

• What it is: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load.

• Affected versions: Vulnerable legacy versions of Plex Media Server prior to security updates.

• Exploitation status: Added to CISA KEV due to active exploitation.

• Patch available: Yes, upgrade to the latest Plex Media Server release.

• CISA due date: 2026-11-10

• Operational risk: Privilege escalation or code execution on systems running media server software with elevated permissions.

CVE-2026-96655 — Plex Media Server

• What it is: Plex Media Server contains a server-side request forgery vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via transcoding endpoints.

• Affected versions: Unpatched Plex Media Server versions.

• Exploitation status: Confirmed active exploitation.

• Patch available: Yes, update via Plex official channels.

• CISA due date: 2026-11-10

• Operational risk: Exposure of internal network resources, services, and metadata APIs to authenticated users via server-side request forgery.

CVE-2026-96654 — Plex Media Server

• What it is: Plex Media Server contains an improper neutralization of encoded URI schemes vulnerability allowing attackers to call other plugins functions and supply custom parameters.

• Affected versions: Vulnerable Plex Media Server releases.

• Exploitation status: Actively exploited in the wild.

• Patch available: Yes, apply vendor patch.

• CISA due date: 2026-11-10

• Operational risk: Unauthorized execution or manipulation of internal plugin routines, leading to potential logical abuse or chaining with other flaws.

CVE-2026-96652 — Plex Media Server

• What it is: Plex Media Server contains a server-side request forgery vulnerability allowing token-holding actors to force arbitrary URL lookups via protocol parameters.

• Affected versions: Affected legacy Plex Media Server builds.

• Exploitation status: Under active exploitation observed by threat trackers.

• Patch available: Yes, upgrade immediately.

• CISA due date: 2026-11-10

• Operational risk: Network reconnaissance and internal service probing from the host running the media server.

CVE-2026-110936 — Siemens Software Center

• What it is: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory.

• Affected versions: Unpatched Siemens Software Center installations.

• Exploitation status: Added to CISA KEV catalog following active exploitation confirmation.

• Patch available: Yes, apply Siemens software updates.

• CISA due date: 2026-11-10

• Operational risk: Local privilege escalation via DLL hijacking on engineering or administrative workstations utilizing Siemens tooling.

Exploitation Context

This reporting period's additions to CISA's Known Exploited Vulnerabilities catalog underscore an aggressive focus by threat actors on perimeter network management systems, collaboration platforms, and media/utility infrastructure. Critical vulnerabilities like the Arista VeloCloud and Collabora CODE server flaws highlight how remote command and injection vectors continue to provide attackers with direct footholds into enterprise core networks and document repositories.

Concurrently, multiple vulnerabilities discovered across Plex Media Server and enterprise utility software illustrate a compounding risk profile where chaining lower-severity primitives enables broader system compromise. Organizations must prioritize patching network-facing assets carrying high EPSS probabilities and direct remote execution potential before mandatory CISA deadlines elapse.

Remediation Priorities

Detection and Monitoring Guidance

• CVE-2026-11462 (Arista):

  • Log Sources: VeloCloud Orchestrator access logs, database query error logs, WAF logs.

  • Behavioral Indicators: Unusual HTTP request structures containing query control characters targeting API endpoints or callbacks.

  • Monitoring Gap / Detection Artifacts: Encrypted HTTPS traffic requires SSL inspection or endpoint database auditing to detect anomalous input strings.

• CVE-2026-11044 (Collabora):

  • Log Sources: NextCloud application logs, container execution logs, process spawning telemetry.

  • Behavioral Indicators: Unexpected child processes spawned by the CODE server or web service runtime.

  • Monitoring Gap / Detection Artifacts: Standard web logs may lack payload visibility without application-layer runtime defense.

• CVE-2026-10693 (EG Secure Solutions):

  • Log Sources: System process execution logs, Windows Security event logs, EDR telemetry.

  • Behavioral Indicators: SiteGuard server processes spawning command shells or unauthorized binaries.

  • Monitoring Gap / Detection Artifacts: Local vector requires host-based sensor coverage on internal servers running SiteGuard.

• CVE-2026-96656 (Plex):

  • Log Sources: Plex Media Server application logs, filesystem activity monitors.

  • Behavioral Indicators: Unexpected file creation or modification within application directories by administrative users.

  • Monitoring Gap / Detection Artifacts: Requires baseline knowledge of expected media directory modifications.

• CVE-2026-96655 (Plex):

  • Log Sources: Transcoder HTTP access logs, network firewall connection logs.

  • Behavioral Indicators: Outbound HTTP requests from the Plex server to internal subnet IP addresses or loopback targets via transcoding parameters.

  • Monitoring Gap / Detection Artifacts: Internal egress filtering can block unverified outbound connections from media servers.

• CVE-2026-96654 (Plex):

  • Log Sources: Plex plugin framework logs and web API access trails.

  • Behavioral Indicators: Malformed URI schemes invoking unauthorized plugin functions with unexpected parameter sets.

  • Monitoring Gap / Detection Artifacts: High noise floor in default application debug logs requires strict log filtering.

• CVE-2026-96652 (Plex):

  • Log Sources: Plex server network logs, DNS query logs originating from the media host.

  • Behavioral Indicators: Requests containing full URLs inside protocol parameters pointing to external or internal infrastructure.

  • Monitoring Gap / Detection Artifacts: Lack of payload inspection on authenticated API endpoints.

• CVE-2026-110936 (Siemens):

  • Log Sources: File integrity monitoring, Windows Event logs for binary loads.

  • Behavioral Indicators: Unsigned or unexpected DLLs loaded from application working directories by Siemens Software Center.

  • Monitoring Gap / Detection Artifacts: Requires workstation-level DLL load telemetry to identify rogue search path resolution.

Hackerstorm Analysis

This week's KEV catalog updates highlight a diverse threat landscape spanning enterprise networking infrastructure, collaborative productivity platforms, media management tools, and local software suites. Attackers are actively exploiting application-layer logic flaws, input validation gaps, and environmental search paths to bypass authentication or execute arbitrary code. Security teams must treat external-facing injection and request forgery vectors with utmost urgency, ensuring strict asset discovery and rapid patch deployment within CISA-mandated timelines.

What you should do next

Ensure you understand the latest KEV additions to cover off any potential gaps in your remediation activities.  View all weekly reports here

Further Reading

The following resources offer technical analysis to help integrate CISA KEV data into operational triage workflows and stay aligned with updated mitigation guidance.

About This Report

Attribution Note

This analysis is based on publicly available reporting and security research summaries. Some technical details may change as additional information becomes available. 

Author Information

Timur Mehmet | Founder & Lead Editor

Timur is a veteran Information Security professional with a career spanning over three decades. Since the 1990s, he has led security initiatives across high-stakes sectors, including Finance, Telecommunications, Media, and Energy. Professional qualifications over the years have included CISSP, ISO27000 Auditor, ITIL and technologies such as Networking, Operating Systems, PKI, Firewalls. For more information including independent citations and credentials, visit our About page.

Contact: This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Standards

This article adheres to Hackerstorm.com's commitment to accuracy, independence, and transparency:

• Fact-Checking: All statistics and claims are verified against primary sources and authoritative reports
• Source Transparency: Original research sources and citations are provided in the References section below
• No Conflicts of Interest: This analysis is independent and not sponsored by any vendor or organization
• Corrections Policy: We correct errors promptly and transparently. Report inaccuracies to This email address is being protected from spambots. You need JavaScript enabled to view it.

Editorial Policy: Ethics, Non-Bias, Fact Checking and Corrections

Learn More: About Hackerstorm.com | FAQs

Source Transparency

• CVE-2026-11462:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-11462

• CVE-2026-11044:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-11044

• CVE-2026-10693:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-10693

• CVE-2026-96656:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-96656

• CVE-2026-96655:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-96655

• CVE-2026-96654:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-96654

• CVE-2026-96652:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-96652

• CVE-2026-110936:

  • CISA KEV catalog (CISA KEV catalog) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

  • NIST NVD (NVD) — https://nvd.nist.gov/vuln/detail/CVE-2026-11044" target="_blank" rel="noopener">https://nvd.nist.gov/vuln/detail/CVE-2026-110936

Analyst Notes

• No ransomware attribution was publicly associated with this week's KEV additions at the time of publication.
• No confirmed threat actor attribution was available beyond CISA's confirmation of active exploitation for the majority of entries.
• Where vendor advisory details or EPSS values were unavailable at publication time, placeholders were retained pending analyst validation and vendor updates prior to final publication.