Two fresh KEV entries are already being exploited
CISA added six vulnerabilities to the Known Exploited Vulnerabilities catalog on October 20, and two of them come with same-day press confirming live attacks. That is the difference between patch eventually and patch now.
CVE-2026-110936 in Siemens Software Center is an uncontrolled search path element flaw, CVSS 6.7. Help Net Security and SecurityWeek both report it is being exploited in an active ClickFix malware campaign. If you have Siemens Software Center installed on engineering or OT-adjacent workstations, treat this as urgent.
CVE-2026-106931 in EG Secure Solutions SiteGuard Server Edition is an OS command injection flaw, CVSS 7.8. Cyber Security News reports attackers are exploiting the SiteGuard WAF vulnerability to gain full control of servers. The irony of a web application firewall becoming the entry point is not lost on anyone.
The rest of the KEV batch: Plex Media Server
Four of the six new KEV entries are Plex Media Server flaws: CVE-2026-96652 and CVE-2026-96655 (both server-side request forgery, CVSS 4.3), CVE-2026-96654 (encoded URI scheme neutralization, CVSS 6.5), and CVE-2026-96656 (external control of file name or path, CVSS 7.2). None are flagged ransomware-linked, but KEV listing means exploitation is confirmed. If Plex runs anywhere in your environment, including shadow installs on employee machines, patch it.
The non-Microsoft exploited-CVE tracker in Senserva follows these CISA KEV additions daily, so you can confirm your own exposure against the current list rather than cross-checking by hand.
Hot movers worth a look
Beyond the new adds, several KEV-listed CVEs are carrying high exploitation signal. CVE-2026-41940 in WebPros cPanel and WHM (CVSS 9.8, EPSS 0.9853) is ransomware-linked and missing authentication for a critical function. CVE-2026-35273 in Oracle PeopleSoft PeopleTools (CVSS 9.8, EPSS 0.9668) and CVE-2026-63077 in JetBrains TeamCity (CVSS 9.8, EPSS 0.8957) are both ransomware-linked as well.
CVE-2026-104935 in Ivanti Connect Secure, an authentication bypass by spoofing (CVSS 8.6), sits at the top of the hot list and is KEV-listed. Internet-facing Ivanti gateways remain a favorite target, so verify your version.
Microsoft watch: October updates can break Exchange
Before you push this month's Windows rollups, note that Microsoft has confirmed the October Windows updates can break Exchange Server email services, per Cyber Security News. Validate on a pilot Exchange host before broad deployment.
The cumulative Windows rollups continue to carry very large CVE counts: KB5126646 for Windows Server 2025 covers 1041 CVEs, KB5126655 for Windows Server 2022 covers 977, and the Windows 10 rollups KB5126651 and KB5126657 cover 918 and 899 respectively, all rated Critical and all KEV-tagged. Senserva's free Microsoft Patch Tracker ranks your open patches by KEV, EPSS, and ransomware linkage so you can sequence the rollout.
Also on the radar
CISA published a StopRansomware advisory on SafePay ransomware alongside several ICS advisories covering Moxa, HMS Networks, and Hitachi Energy products. CERT-EU issued advisory 2026-018 on critical PHP vulnerabilities. A critical unauthenticated Drupal RCE, CVE-2026-108097, was also reported and is worth checking if you run Drupal sites.
On the identity side, attackers registered new Teams-based domains with fake login pages to harvest credentials, and researchers continue to track Microsoft tech support scam operations. Both are reminders that phishing against your Entra ID users does not wait for a patch cycle.
Do this first
Priorities for today, grounded in the facts above:
- Patch CVE-2026-110936 (Siemens Software Center) and CVE-2026-106931 (SiteGuard Server Edition) now; both are actively exploited and KEV-listed.
- Update Plex Media Server for CVE-2026-96652, 96654, 96655, and 96656.
- Check Ivanti Connect Secure (CVE-2026-104935), cPanel and WHM (CVE-2026-41940), PeopleSoft (CVE-2026-35273), and TeamCity (CVE-2026-63077) against your inventory.
- Pilot the October Windows rollups on an Exchange host before broad deployment to avoid the confirmed email outage.
- Review Teams-themed phishing domains and user reporting against your Entra ID tenant.
Sources
- CISA Cybersecurity Advisories: CISA Adds Six Known Exploited Vulnerabilities to Catalog (2026-10-20)
- Help Net Security: Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign (2026-10-20)
- SecurityWeek: Siemens Software Center Vulnerability Exploited in ClickFix Malware Attacks (2026-10-19)
- Cyber Security News: Hackers Exploit SiteGuard WAF Vulnerability That Could Give Them Full Control of Servers (2026-10-19)
- Cyber Security News: Microsoft Confirms October Windows Updates Can Break Exchange Server Email Services (2026-10-19)
- CISA Cybersecurity Advisories: #StopRansomware: SafePay Ransomware (2026-10-20)
- Cyber Security News: Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication (2026-10-19)
- Cyber Security News: Hackers Registered New Teams-Based Domains and Used a Login Page to Steal Your Logins (2026-10-19)
- CERT-EU: 2026-018: Critical Vulnerabilities in PHP (2026-10-20)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-21.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.