This Week in Threats: Oct 20–Oct 27, 2026

Weekly Threat Summary

8 vulnerabilities were added to the CISA Known Exploited Vulnerabilities (KEV) catalog since the last roundup. The highest CVSS score is 9.9.

This week includes 2 critical-severity vulnerabilities (CVSS 9.0+) that require immediate attention.

This Week's Vulnerabilities

CVE-2026-114625: Arista VeloCloud Orchestrator SQL Injection Vulnerability

• CVSS Score: 9.9 (CRITICAL)
• Date Added: 2026-10-23
• Description: Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-110447: Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

• CVSS Score: 9.2 (CRITICAL)
• Date Added: 2026-10-23
• Description: Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

• CVSS Score: 7.8 (HIGH)
• Date Added: 2026-10-20
• Description: EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-96656: Plex Media Server External Control of File Name or Path Vulnerability

• CVSS Score: 7.2 (HIGH)
• Date Added: 2026-10-20
• Description: Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-110936: Siemens Software Center Uncontrolled Search Path Element Vulnerability

• CVSS Score: 6.7 (MEDIUM)
• Date Added: 2026-10-20
• Description: Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-96654: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability

• CVSS Score: 6.5 (MEDIUM)
• Date Added: 2026-10-20
• Description: Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-96652: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

• CVSS Score: 4.3 (MEDIUM)
• Date Added: 2026-10-20
• Description: Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-96655: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

• CVSS Score: 4.3 (MEDIUM)
• Date Added: 2026-10-20
• Description: Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user...
• Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

What This Means for You

If you run any of the affected products, patch immediately. Every vulnerability in this roundup is in CISA's KEV catalog, which lists only flaws with confirmed exploitation in the wild.

Use the CVSS Calculator to assess how these scores apply to your specific environment.

Cert Study Angles

These CVEs map directly to certification exam objectives. Use them as real-world case studies:

CompTIA Security+

• CVE-2026-114625 → D2 Threats & Vulnerabilities, D3 Security Architecture
• CVE-2026-110447 → D2 Threats & Vulnerabilities, D3 Security Architecture
• CVE-2026-106931 → D2 Threats & Vulnerabilities
• CVE-2026-110936 → D4 Security Operations

ISC2 CISSP

• CVE-2026-114625 → D6 Security Assessment
• CVE-2026-110447 → D6 Security Assessment
• CVE-2026-106931 → D6 Security Assessment
• CVE-2026-96656 → D6 Security Assessment
• CVE-2026-110936 → D6 Security Assessment, D7 Security Operations, D8 Software Development
• CVE-2026-96654 → D6 Security Assessment
• CVE-2026-96652 → D6 Security Assessment
• CVE-2026-96655 → D6 Security Assessment

See all CVEs mapped to your cert: Exploit Tracker

Tools to Help

• CVSS Calculator: Score these vulnerabilities for your specific environment
• Exploit Tracker: Filter KEV vulnerabilities by certification relevance
• Study Tracker: Track your exam objective completion
• Security+ Practice Quiz: Test your knowledge of vulnerability types and mitigations

Stay Updated

This roundup is published every Tuesday. Bookmark the FixTheVuln Blog to stay on top of the latest threats, or subscribe via RSS.