CISA added four Plex bugs that attackers chain into “Plex2Shell” to its exploited-vulnerabilities list, along with flaws in Siemens Software Center and SiteGuard; fixes for three are due 23 October.
CISA on Tuesday added six vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. Four are in Plex Media Server (CVE-2026-96652, -96654, -96655 and -96656); researcher Zach Main, who reported them to Plex in July, says they can be chained for unauthenticated code execution, and BleepingComputer reports exploitation began around 17 October, first to plant cryptominers. Plex Media Server 1.43.3.10861, released in August, fixes them. The other two are a Siemens Software Center flaw (CVE-2026-110936) that Siemens says was abused in ClickFix campaigns, fixed in version 4.0.9.8, and a command-injection bug in EG Secure Solutions’ SiteGuard Server Edition web application firewall (CVE-2026-106931). Under CISA’s catalogue, federal civilian agencies must patch CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by 23 October, and the other three by 3 November.
Sources: CISA · BleepingComputer · The Hacker News · CISA KEV catalogue