CISA added six CVEs to KEV on Oct 20 (catalog 2026.10.20). Under BOD 26-04 federal agencies have tight clocks, and two of the entries carry CISA's forensic-triage flag, meaning collect evidence before you patch:

• Due Oct 23, forensic triage required: SiteGuard Server Edition CVE-2026-106931 and Plex Media Server CVE-2026-96656 (Codecs file write).
• Due Oct 23, no triage flag: Plex CVE-2026-96654 (loopback agent functions).
• Due Nov 3: Plex CVE-2026-96652 and CVE-2026-96655 (SSRF and admin-token disclosure), and Siemens Software Center CVE-2026-110936 (DLL side-loading, update to 4.0.9.8).

For triage on a Plex host before updating, image or copy the Plex data directory (Codecs folder, Preferences.xml, logs), save the process list and active network connections, and note any traffic to proxystream[.]st. For SiteGuard, follow EG Secure Solutions' instruction to save the diagnostics bundle before applying the fix. Then patch, and rebuild from clean if you find anything. Even if you aren't federal, use these dates as a ceiling.