On 20 October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added new entries to the Known Exploited Vulnerabilities (KEV) catalog affecting three products: Plex Media Server, Siemens Software Center and EG Secure Solutions SiteGuard Server Edition. Federal Civilian Executive Branch (FCEB) agencies have been given tight remediation deadlines — until 23 October and 3 November 2026. Inclusion in KEV means exploitation has been confirmed as active, which makes rapid patching critically important not only for government entities but for any organizations using these products.
Plex Media Server vulnerabilities: the Plex2Shell chain
According to the original report, four vulnerabilities in Plex Media Server are grouped under the common name Plex2Shell:
- CVE-2026-96652 (CVSS 5.3) — server-side request forgery (SSRF)
- CVE-2026-96654 (CVSS 6.9) — improper neutralization of encoded URI schemes in a web page
- CVE-2026-96655 (CVSS 5.3) — server-side request forgery (SSRF)
- CVE-2026-96656 (CVSS 8.6) — external control of file name or path
According to the original report, fixes are included in Plex Media Server version 1.43.3.10861, released on 3 August 2026. However, it should be noted that no official Plex security advisory specifying the range of vulnerable versions has been found in the available materials, so the full picture of affected versions remains unclear.
Important data discrepancy: the headline of the CISA alert mentions six vulnerabilities, but only four entries are recorded in the deterministic KEV package — CVE-2026-96654, CVE-2026-96656, CVE-2026-110936 and CVE-2026-106931. The vulnerabilities CVE-2026-96652 and CVE-2026-96655 are missing from this package. This may be related to specifics of data mirroring or to the fact that these two CVEs were added separately. Organizations are advised to rely on the full list of six CVEs and remediate all four Plex vulnerabilities without waiting for clarification.
Siemens Software Center and SiteGuard
In addition to the Plex vulnerabilities, CISA highlighted two more actively exploited flaws:
- CVE-2026-110936 (CVSS 8.4) — a malicious DLL loading (DLL sideloading) vulnerability in Siemens Software Center. According to the original report, this flaw is used in ClickFix-type attacks leveraging a platform called Romulus, although these exploitation details have not received independent confirmation in the available materials.
- CVE-2026-106931 (CVSS 8.5) — a command injection vulnerability in EG Secure Solutions SiteGuard Server Edition. According to the original report, the Japanese developer company has confirmed exploitation, but details of the attacks have not been disclosed. The vendor’s original advisory has not been found in the available materials.
Remediation priorities and deadlines
CISA has set two deadlines for federal agencies, and how they are distributed is noteworthy:
- 23 October 2026 — CVE-2026-106931 (SiteGuard, CVSS 8.5), CVE-2026-96656 (Plex, CVSS 8.6) and CVE-2026-96654 (Plex, CVSS 6.9)
- 3 November 2026 — CVE-2026-110936 (Siemens, CVSS 8.4)
It is noteworthy that the prioritization of deadlines does not align with CVSS rankings. The Siemens vulnerability with a score of 8.4 received a later deadline, whereas the Plex vulnerability CVE-2026-96654 with a score of 6.9 fell into the accelerated remediation group. This underscores that when setting deadlines CISA takes into account not only formal severity but also exploitation context, availability of fixes and scale of impact. For security teams this means they should follow KEV deadlines rather than using CVSS scores as the sole prioritization criterion.
Impact assessment
Plex Media Server is widely used both in home and corporate environments to organize media content. Its presence in federal networks may seem unexpected, but the practice of shadow IT services makes this quite realistic. SSRF and path control vulnerabilities in combination create a serious attack vector that can potentially allow an attacker to move through the internal network.
Siemens Software Center is a software management tool for Siemens products used in industrial and corporate environments. DLL sideloading in such a product is particularly dangerous because it can be used to maintain persistence within the infrastructure of critical enterprises.
SiteGuard Server Edition is a web application protection (WAF) solution popular on the Japanese market. A command injection vulnerability in the protection tool itself creates a paradoxical situation: the security tool becomes an entry point for attackers.
Recommendations
- Plex Media Server: update to version 1.43.3.10861 or later. If immediate updating is not possible, restrict network access to the Plex server by removing it from public exposure and segmenting it from critical resources.
- Siemens Software Center: check for updates in Siemens ProductCERT advisories. Until the patch is installed, monitor the integrity of DLL libraries loaded by the application and restrict write permissions in installation directories.
- SiteGuard Server Edition: contact EG Secure Solutions to obtain the latest fix. Audit the WAF configuration and review logs for signs of unauthorized command execution.
- All of the listed CVEs should be added to the priority remediation list regardless of FCEB affiliation — the KEV catalog reflects real-world exploitation, not theoretical risk.
Given that CVSS scores and exploitation details for the Plex vulnerabilities come from a single news source and are not independently confirmed via NVD entries or vendor advisories, organizations should monitor for official recommendations from Plex, Siemens and EG Secure Solutions. Nevertheless, the very fact of inclusion in the KEV catalog is sufficient grounds for immediate response: update affected products by the deadlines set by CISA and scan your networks for unpatched instances of Plex Media Server, Siemens Software Center and SiteGuard Server Edition.
