The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has mandated that all Federal Civilian Executive Branch (FCEB) agencies urgently patch a set of critical vulnerabilities recently added to its Known Exploited Vulnerabilities (KEV) catalog. These flaws include a group of four affecting Plex Media Server—collectively referred to as “Plex2Shell”—alongside serious bugs in Siemens Software Center and EG Secure Solutions’ SiteGuard Server Edition. These flaws are already under active exploitation.
Plex2Shell: Chainable Bugs Lead to Remote Code Vulnerability
A cluster of four vulnerabilities in Plex Media Server—CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656—were discovered and reported by researcher Zach Main. The bugs include two Server-Side Request Forgery (SSRF) flaws, an issue with improperly neutralizing encoded URI schemes, and a file path or name control vulnerability. By chaining them together, attackers could achieve unauthenticated remote code execution. To counter this threat, Plex pushed out version 1.43.3.10861 on August 3, 2026, which addresses all four vulnerabilities. These four have now been officially added to CISA’s KEV list after reports that threat actors are already exploiting them to install cryptocurrency miners and proxy malware.
Active Exploits in Siemens & SiteGuard Components
In addition to the Plex-related flaws, CISA has flagged two more vulnerabilities under active exploit:
- Siemens Software Center – A DLL sideloading vulnerability (CVE-2026-110936, CVSS 8.4) has been abused in attacks leveraging the Romulus platform, particularly in campaigns using ClickFix.
- EG Secure Solutions SiteGuard Server Edition – A command injection flaw (CVE-2026-106931, CVSS 8.5) confirmed by the vendor as actively exploited, though details of the attacks remain limited.
CISA’s remediation deadlines require agencies to patch CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 by October 23, 2026. The remaining flaws—including the Siemens bug and others in the Plex2Shell group—must be patched by November 11, 2026.
Why This Matters & How Agencies Got Here
The KEV catalog is CISA’s tool for flagging vulnerabilities already being weaponized in the wild. Once a vulnerability is listed, federal agencies are legally obligated to respond under a binding operational directive, moving quickly to apply patches or mitigations. The inclusion of Plex2Shell along with the Siemens and SiteGuard vulnerabilities underscores how attackers are chaining multiple weaknesses together for maximum effect, and how even smaller vulnerabilities—when combined—can become dangerous.
The timing of these patches also highlights the challenge for agencies: some flaws have already been disclosed, patched by vendors, and exploited in the wild. Others are being used without public detail, making it harder to defend until full remediation is in place.
What to watch: whether agencies meet the tight October and November deadlines, and whether any yet-undisclosed exploit techniques emerge tied to these vulnerabilities. Cyber defenders should prioritize patching, but also look for signs of exploitation in their networks—especially if Plex, Siemens Software Center, or SiteGuard tools are in use.
