Grade One Press

Technology reporting you can check

News · Security & privacy

CISA adds six actively exploited flaws to catalog under emergency directive

The Cybersecurity and Infrastructure Security Agency added six actively exploited software vulnerabilities to its Known Exploited Vulnerabilities catalog, setting a mandatory three-week federal patching deadline.

Grade One Newsroom · How this is written ↗ · 1 min read

Sources: 1 · top grade 1How evidence is graded

CISA adds six exploited software flaws to catalog under federal directive

Grade 1 · Primary

Source: Cybersecurity and Infrastructure Security Agency

What changed
CISA added six actively exploited software vulnerabilities to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to remediate affected appliances.
Who it affects
US Federal Civilian Executive Branch agencies and enterprise IT networks running affected Plex, Siemens, and SiteGuard software.
What it does not tell you
The catalog records confirmed active exploitation in the wild but does not state whether civilian federal agency networks suffered intrusions.

The full story Check the source

The Cybersecurity and Infrastructure Security Agency added six actively exploited software vulnerabilities to its Known Exploited Vulnerabilities catalog on 22 October 2026 [1].

Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must apply vendor mitigations or remove exposed instances by the cataloged remediation deadline [1]. The newly cataloged flaws include vulnerabilities affecting Plex Media Server, Siemens Software Center, and EG Secure Solutions SiteGuard [1].

CISA established that all six vulnerabilities have been observed in active exploitation campaigns targeting internet-connected management and application interfaces [1].

What it measures

Federal vulnerability governance and mandatory patching directives for civilian executive branch IT infrastructure under Binding Operational Directive 26-04 [1].

What it does not tell you

The catalog entry does not attribute attacks to specific nation-state threat actors or disclose how many civilian enterprise networks were breached prior to cataloging [1].

Sources and their grades

  1. Cybersecurity and Infrastructure Security Agency, Known Exploited Vulnerabilities Catalog. Read 22 October 2026. Grade 1 · Primary Updates to CISA KEV catalog under Binding Operational Directive 26-04.

A grade says how much weight a source will take, from 1 (a body that can compel an answer and has nothing to sell) to 5 (somebody describing what they sell, or themselves). The standard sets out what each grade may be used for.

Filed under CISA Cybersecurity KEV Plex Siemens Vulnerabilities

Comments

Commenting needs an account, made with nothing but an email address. A first comment is read before it appears.

More news

See all