CISA and FBI Issue Advisory on SafePay Ransomware Targeting Critical Infrastructure
Oktober 20, 2026CISA und FBI warnen vor SafePay-Ransomware: 600 Angriffe auf kritische Infrastruktur
Oktober 20, 2026The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation by malicious actors. The additions include four flaws in Plex Media Server, one in EG Secure Solutions SiteGuard Server Edition, and one in Siemens Software Center. This action underscores the immediate risk these software components pose to federal and private sector infrastructure.
CISA warns that attackers are actively exploiting four vulnerabilities in Plex Media Server through a chain known as 'Plex2Shell'. The specific vulnerabilities added to the catalog are CVE-2026-96652, a Server-Side Request Forgery (SSRF) vulnerability; CVE-2026-96654, involving improper neutralization of encoded URI schemes in a web page; CVE-2026-96655, another SSRF vulnerability; and CVE-2026-96656, an external control of file name or path vulnerability. These flaws allow attackers to chain exploits to breach servers.
The remaining two vulnerabilities added to the KEV Catalog affect other enterprise software. CVE-2026-106931 is an OS Command Injection Vulnerability in EG Secure Solutions SiteGuard Server Edition. CVE-2026-110936 is an Uncontrolled Search Path Element Vulnerability in Siemens Software Center. CISA notes that these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
The inclusion of these CVEs triggers requirements under Binding Operational Directive (BOD) 26-04, which establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by CVEs listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation. Agencies must also check whether threat actors compromised the system before the patch was applied.
While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. Organizations aware of an exploited vulnerability not currently listed in the KEV Catalog can submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.
