# Four living-room bugs were due Friday

2026-10-20

CISA added six exploited flaws today. Four of them are in Plex Media Server. Two of those are due 23 October. SiteGuard and Siemens Software Center are on the same list. A living-room port is not a federal mailbox.

Canonical: https://www.fabiocti.com/notes/four-living-room-bugs-were-due-friday/
Author: Fabio Correia

The catalogue grew by a media server. Friday is three days out.

CISA put six names in the Known Exploited Vulnerabilities catalog today. Four are Plex Media Server: two server-side request forgeries, one encoded-URI problem, one file-name control. Two of the four, CVE-2026-96654 and CVE-2026-96656, are due 23 October. The other two Plex rows, and Siemens Software Center, are due 3 November. EG Secure Solutions’ SiteGuard Server Edition is the sixth. The federal clock is BOD 26-04: patch what is exposed and check whether anyone used it before the patch.

A Plex box on a home network is not a civilian agency. It is also not “safe because it is a TV.” The due date is for systems the directive covers. Everyone else still has a port that CISA now says is being used.

## What Friday will be asked to cover

It will be briefed as “Plex was breached.” A CVE on the list is evidence of exploitation somewhere, not a finding that your library left. It will be briefed as four equally urgent rows. Two of them are due in three days. Two are not. SiteGuard is a Japanese WAF product. Do not paste it onto a living-room NAS.

If you run Plex on a network that can be reached, treat the two Friday CVEs as a look, not only a pull. If you run SiteGuard or Siemens Software Center, those are separate rows. A patched box still needs the question the directive now asks: was it used first.

Four living-room bugs and a WAF and a software center. Keep the due dates on the right names.