CISA Orders Agencies to Patch Exploited “Plex2Shell” Flaws in Plex Media Server, Plus Siemens and SiteGuard Bugs

US federal agencies are under orders to move fast on a fresh set of security flaws that attackers are already exploiting. On Tuesday, the Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — the list that carries mandatory remediation deadlines for civilian agencies — headlined by a cluster of bugs in the popular Plex Media Server software.

The four Plex flaws, collectively nicknamed Plex2Shell, include two server-side request forgery weaknesses (CVE-2026-96652 and CVE-2026-96655, both rated 5.3), an issue with how encoded web addresses are handled (CVE-2026-96654, 6.9), and a more serious flaw letting attackers control file names or paths (CVE-2026-96656, 8.6). Individually they look modest; together, they are dangerous.

Chained together, the flaws hand over the server

Security researcher Zach Main, who discovered and reported the Plex vulnerabilities, found that a remote attacker can chain all four to execute code on a target system without any login at all. Plex fixed the issues in Media Server version 1.43.3.10861, released on August 3, 2026 — but unpatched servers remain exposed, and another researcher has reported threat actors already weaponising the bugs to install cryptocurrency miners and proxy malware on compromised machines.

Two more exploited bugs on the list

CISA also flagged a DLL sideloading vulnerability in Siemens Software Center (CVE-2026-110936, rated 8.4), which has been abused in so-called ClickFix attacks delivered through a platform called Romulus, and an operating-system command injection flaw in EG Secure Solutions’ SiteGuard Server Edition (CVE-2026-106931, rated 8.5) that can hand an attacker root or SYSTEM-level control. The Japanese vendor has confirmed that one is being exploited in the wild.

For home users, the headline is Plex: anyone running a Plex Media Server should confirm it is updated to at least the August build, since servers reachable from the internet are precisely the ones automated attackers scan for. For federal IT teams, the KEV listing turns that advice into a deadline — a reminder that in 2026, even media-streaming software is part of the national attack surface.

Source: The Hacker News