Exploited this week

CVEs added to the CISA Known Exploited list or published and exploited in the last 7 days.

8 CVEs were exploited in the wild or newly confirmed as exploited in the last 7 days. Patch these first. Highest priority: CVE-2026-110447 (Collabora Online – Built-in CODE Server OS Command Injection Vulnerability), score 82/100.

• CVE-2026-110447 CRITICAL 9.2 EXPLOITED MITIGATE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
• CVE-2026-114625 CRITICAL 9.9 EXPLOITED UPGRADE Arista VeloCloud Orchestrator SQL Injection Vulnerability
• CVE-2026-106931 HIGH 7.8 EXPLOITED UPGRADE UPGRADE EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability
• CVE-2026-96656 HIGH 7.2 EXPLOITED UPGRADE Plex Media Server External Control of File Name or Path Vulnerability
• CVE-2026-96654 MEDIUM 6.5 EXPLOITED UPGRADE Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
• CVE-2026-110936 MEDIUM 6.7 EXPLOITED UPGRADE Siemens Software Center Uncontrolled Search Path Element Vulnerability
• CVE-2026-96652 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
• CVE-2026-96655 MEDIUM 4.3 EXPLOITED UPGRADE Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability

FAQ

What does exploited in the wild mean?

Attackers are already using the flaw against real systems. CISA confirms this on its Known Exploited Vulnerabilities (KEV) list.

How fast should I patch an exploited CVE?

Within days, not weeks. CISA gives US agencies a short due date for KEV entries, and the same urgency applies to every organisation.

What if there is no fix yet?

Follow the downgrade or mitigation steps on the CVE page, restrict exposure, and monitor the vendor advisory.