CISA Adds Plex2Shell, Siemens and SiteGuard Flaws to Its Exploited List

Six vulnerabilities across three products — Plex Media Server, Siemens Software Center and EG Secure Solutions SiteGuard Server Edition — were added on 20 October 2026 to the U.S. CISA Known Exploited Vulnerabilities (KEV) catalog. A KEV listing means there is evidence of real-world abuse, not just a theoretical risk, and U.S. federal civilian agencies now have hard deadlines to patch.

What happened

Plex2Shell (four Plex Media Server CVEs). The largest group is a set of four Plex Media Server bugs that, taken together, are being called Plex2Shell:

On their own, most of these score as medium severity. The researcher who found them, Zach Main, showed that a remote attacker can chain all four to reach unauthenticated remote code execution on the server. Plex fixed the issues in Plex Media Server 1.43.3.10861, released on 3 August 2026. Independent research since then shows attackers using the chain to install cryptocurrency miners and proxy malware on exposed servers.

Siemens Software Center (CVE-2026-110936, CVSS 8.4). A DLL sideloading flaw that has been used in ClickFix-style social-engineering campaigns delivered through a platform called Romulus.

EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931, CVSS 8.5). A command injection bug. The Japanese vendor has confirmed it is being exploited, but no details about the activity have been published yet.

Deadlines for U.S. federal agencies: CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 must be fixed by 23 October 2026. The other three are due by 3 November 2026.

Why it matters

• Medium-severity bugs can still lead to a full compromise. Plex2Shell is a textbook example: no single bug is critical, but the chain is. Triage that only looks at individual CVSS scores will rank these too low.
• Media servers are shadow IT. Plex often runs on home labs, NAS boxes or "temporary" office machines that nobody tracks, and it is commonly reachable from the internet. Those are exactly the hosts attackers are now mining and using as proxies.
• A proxy foothold is worth more than the mining income. A compromised server that relays traffic gives attackers clean infrastructure for their next operation, and inside your network it becomes a starting point for moving further in.
• Sideloading plus ClickFix gets past user caution. When a trusted, signed application loads a malicious DLL, many endpoint controls stop paying attention.

What to do

1. Update Plex Media Server to 1.43.3.10861 or later right away, including any instance on a NAS, in a container or on a staff machine.
2. Remove Plex from the internet unless there is a business need for it. If remote access is required, put it behind a VPN or an authenticated reverse proxy.
3. Check for signs of compromise on any Plex host that was exposed before patching: unexpected CPU load, unknown processes or services, new outbound connections and proxy listeners.
4. Patch Siemens Software Center and SiteGuard Server Edition, following each vendor's advisory, even if you are outside the U.S. federal deadlines.
5. Train staff on ClickFix lures (fake "fix" or "verify" prompts that ask users to paste commands) and watch for DLL loads from unusual paths.
6. Treat KEV as your priority list. If a CVE is on it and you run the product, patch it ahead of your normal cycle.

Exposures like these are what vulnerability scanning is built to catch: regular, authenticated checks across all your hosts — including the forgotten media server — that flag known-exploited CVEs such as these, so they get patched before an attacker finds them.

Reported by The Hacker News — read the original coverage. Official list: CISA KEV catalog.