Six Flaws Confirmed Under Active Attack, Now on CISA's Mandatory Patch List

In short: CISA has confirmed real-world exploitation of six vulnerabilities and placed them on its Known Exploited Vulnerabilities Catalog. Four of the six hit Plex Media Server, covering two SSRF bugs, a URI-scheme handling flaw and a file-path control issue; the remaining two are an OS command injection in EG Secure Solutions SiteGuard Server Edition and an uncontrolled search path flaw in Siemens Software Center. Because the flaws are already being exploited, Binding Operational Directive 26-04 forces federal civilian agencies to fast-track fixes on any exposed system that could hand attackers full control, and to check for prior compromise first.

🤖This summary was generated automatically by AI from CISA Advisories's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.