CISA Adds Six Exploited Flaws, Including Reported Plex2Shell

CISA added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 20, saying it had evidence the flaws were being exploited. The entries affect Plex Media Server, EG Secure Solutions SiteGuard Server Edition and Siemens Software Center. [1]

Six entries across three products

Four entries concern Plex Media Server: CVE-2026-96652 and CVE-2026-96655 are server-side request forgery vulnerabilities; CVE-2026-96654 involves improper handling of encoded URI schemes; and CVE-2026-96656 allows external control of a file name or path. The other two are CVE-2026-106931, an OS command-injection flaw in SiteGuard Server Edition, and CVE-2026-110936, an uncontrolled-search-path vulnerability in Siemens Software Center. [1]

The CISA alert identifies each weakness but does not itself describe the four Plex issues as one exploit chain. WindowsForum reports that researchers have grouped them under the name “Plex2Shell” and linked them in an attack path. That chain description is attributed reporting, not a statement in CISA’s alert; administrators should consult the relevant vendor guidance rather than assume every Plex installation is affected in the same way. [1] [4]

Siemens publishes a fixed version

Siemens says CVE-2026-110936 affects Software Center versions earlier than 4.0.9.8 and can permit an authenticated local attacker to place a malicious DLL on an uncontrolled search path. The vendor recommends version 4.0.9.8 or later and says existing installations update on the next startup. [2]

The Hacker News reported that threat actors abused a signed Siemens executable with a crafted DLL in ClickFix activity. That campaign detail is reported coverage, not evidence that Siemens’ software update channel was breached. CISA’s alert does not provide product-specific SiteGuard remediation details, so organizations using it should check EG Secure Solutions’ guidance. [1] [3]

CISA’s KEV catalog is a prioritization resource for known exploited issues. Its binding remediation deadlines apply to federal civilian agencies under the cited directive; CISA also encourages other organizations to use the catalog in risk-based vulnerability management. The entry is a reason to assess exposure promptly, not proof that any particular installation was compromised. [1]

Sources

[1] CISA: Adds Six Known Exploited Vulnerabilities to Catalog [2] Siemens: SSA-580366 Security Advisory [3] The Hacker News: ClickFix attackers exploit Siemens Software Center flaw [4] WindowsForum: CISA KEV adds Plex2Shell, Siemens and SiteGuard flaws