CISA has confirmed that attackers are exploiting these 4 vulnerabilities. If you use any of the products below, check that the fixes are installed today.
EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931)
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Plex Media Server (CVE-2026-96656)
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Plex Media Server (CVE-2026-96655)
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Plex Media Server (CVE-2026-96654)
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Switch on two-step sign-in
Email, banking and Microsoft 365 or Google accounts first. A stolen password alone is then not enough to get in.
Doing it once, properly
The lowest quote rarely stays the lowest. Work that skips the security basics tends to be redone from scratch later, and redoing it costs more than doing it properly once.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-106931 on the National Vulnerability Database
- CVE-2026-96656 on the National Vulnerability Database
- CVE-2026-96655 on the National Vulnerability Database
- CVE-2026-96654 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.