CISA Orders Agencies to Patch Exploited Plex, Siemens, and SiteGuard Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday expanded its Known Exploited Vulnerabilities (KEV) catalogue. Added to it were four flaws in Plex Media Server, collectively dubbed Plex2Shell, alongside two separate vulnerabilities affecting products from Siemens and Japan's EG Secure Solutions.

Plex2Shell

The four Plex bugs carry their own identifiers: CVE-2026-96652 and CVE-2026-96655 are server-side request forgery (SSRF) flaws; CVE-2026-96654 covers improper neutralisation of encoded URI schemes in a web page; and CVE-2026-96656 — external control of a file name or path — tops the group with a CVSS score of 8.6.

According to security researcher Zach Main, who found and reported the issues, a remote attacker can chain all four together to achieve unauthenticated remote code execution. Fixes shipped in Plex Media Server 1.43.3.10861, released back on August 3, 2026.

The trigger for the KEV listing was a report from a researcher known as boredhackerblog, who found that threat actors are already weaponising the flaws to deploy cryptocurrency miners and proxy malware.

Siemens and SiteGuard

CISA also flagged two further vulnerabilities as actively exploited. The first is a DLL sideloading flaw in Siemens Software Center (CVE-2026-110936, CVSS 8.4), abused in ClickFix attacks via a platform called Romulus. The second is a command injection bug in SiteGuard Server Edition from EG Secure Solutions (CVE-2026-106931, CVSS 8.5), which the Japanese vendor has confirmed as exploited. No further details about the attacks are yet available.

Deadlines

Federal Civilian Executive Branch (FCEB) agencies must remediate CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 by October 23, 2026, and the rest by November 3, 2026.

Source: The Hacker News