CISA Adds Six Known Exploited Vulnerabilities to Catalog

SiteGuard Server Edition has an OS command injection flaw (CWE-78) that lets an attacker run arbitrary operating-system commands. The published CVSS 4.0 vector rates the attack as local, low complexity, and requiring only low privileges, with no user interaction, and with high impact to confidentiality, integrity, and availability on the host. Successful exploitation can yield command execution as root on Unix-like systems or as SYSTEM on Windows. The product is a host-based web application firewall, so affected systems are servers where SiteGuard Server Edition is installed; specific version ranges are not given in the advisory data. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat this as a local privilege-escalation issue: apply the vendor's SiteGuard Server Edition security update as soon as a fixed build is published, and until then limit who can run or interact with the product to trusted administrators. Review local accounts and host logs for unexpected OS command execution under the SiteGuard process, and do not expose management or shell access on the host more broadly than necessary.

Siemens Software Center, in all versions, loads dynamic-link libraries from an uncontrolled search path (CWE-427). An authenticated local attacker who already has high privileges can place a crafted DLL in a directory the application searches, so the program loads that library. Successful exploitation runs arbitrary code with the privileges of Siemens Software Center and can fully compromise confidentiality, integrity, and availability on that system. The issue is local only: it requires high privileges, no user interaction, and does not extend impact to other systems under the published CVSS 4.0 score of 8.4. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat every installed copy of Siemens Software Center as affected until Siemens publishes a fixed build, and apply that update as soon as it is available. Until then, limit who can write to directories the application searches for DLLs, run the software only with the least privilege required, and review local accounts that already have high privileges on engineering workstations.

CVE-2026-96656 is an arbitrary file write vulnerability in Plex Media Server versions prior to 1.43.3.10861. The flaw is triggered via the 'TranscoderH264Options' preference, which is appended verbatim to x264's command-line options, allowing an admin user to inject parameters. This can be combined with the server's behavior of loading all .so files at startup without signature, execute-bit, or symbol checks, potentially leading to remote code execution. The vulnerability is rated as high severity (CVSS 8.6) and requires administrative access to exploit. There are no known public exploits or active exploitation reports as of now.

Do: Upgrade Plex Media Server to version 1.43.3.10861 or later immediately. Review the 'TranscoderH264Options' setting in your server configuration for any unexpected or suspicious content. Audit any custom .so files or shared libraries placed in the Plex installation directories.