Cybersecurity
CISA adds exploited Plex, Siemens and SiteGuard flaws to catalog
CISA added four Plex Media Server flaws and two other bugs to its exploited-vulnerabilities list, while researchers said the Plex issues could be chained for unauthenticated remote code execution.
- CISA added four Plex Media Server vulnerabilities, grouped as Plex2Shell, to its Known Exploited Vulnerabilities catalogue on Tuesday.
- Zach Main said the Plex flaws could be chained to achieve unauthenticated remote code execution, and Plex fixed them in version 1.43.3.10861 on 3 August 2026.
- boredhackerblog said threat actors were using the Plex flaws to deploy cryptocurrency miners and proxy malware.
- CISA also listed a DLL sideloading flaw in Siemens Software Center and a command injection bug in EG Secure Solutions SiteGuard Server Edition as actively exploited.
- CISA told Federal Civilian Executive Branch agencies to patch CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by 23 October 2026, and the rest by 3 November 2026.
CISA added four Plex Media Server flaws to its Known Exploited Vulnerabilities catalogue on Tuesday. The issues were grouped under the label Plex2Shell and carried CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656.
Security researcher Zach Main said a remote attacker could combine the four bugs to obtain unauthenticated remote code execution. Plex addressed the issues in Media Server 1.43.3.10861, which it released on 3 August 2026.
CISA said the addition followed a report from researcher boredhackerblog, who said threat actors were using the flaws to deploy cryptocurrency miners and proxy malware. The agency also marked two other vulnerabilities as actively exploited.
One was a DLL sideloading flaw in Siemens Software Center, listed as CVE-2026-110936, which CISA said had been used in ClickFix attacks through a platform called Romulus. The other was a command injection bug in EG Secure Solutions SiteGuard Server Edition, CVE-2026-106931, which the company confirmed was being exploited.
CISA told Federal Civilian Executive Branch agencies to patch CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by 23 October 2026. It set 3 November 2026 as the deadline for the remaining issues.
Named in this story
People
- Zach Main
- said the four Plex flaws could be chained for unauthenticated remote code execution
- boredhackerblog
- reported that threat actors were using the flaws to deploy miners and proxy malware
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the flaws to its exploited-vulnerabilities catalogue and set patch deadlines
- Federal Civilian Executive Branch
- had agencies told by CISA to apply the fixes
Products and systems
- Plex Media Server
- had four vulnerabilities grouped as Plex2Shell
- Siemens Software Center
- had a DLL sideloading flaw that CISA said was being abused
- Romulus
- was the platform used in the ClickFix attacks
- EG Secure Solutions SiteGuard Server Edition
- had a command injection bug that the company confirmed was being exploited
How the source tells it
Matter-of-fact advisory copy, with urgency coming from patch deadlines and threat emphasis from active-exploitation claims.
- urgency the close patch deadlines and urging to apply fixes made the piece time-sensitive
- threat emphasis active exploitation, weaponisation and remote code execution claims were used to stress impact