CISA Flags Six Exploited Flaws Across Plex, Siemens and SiteGuard Products

CISA added six vulnerabilities affecting Plex Media Server, Siemens Software Center and EG Secure Solutions’ SiteGuard Server Edition to its Known Exploited Vulnerabilities catalog on 2026-10-20, citing evidence of active exploitation.

The CISA alert covers four Plex flaws, one Siemens vulnerability and one SiteGuard command-injection issue. US federal remediation deadlines begin on 2026-10-23.

CISA’s action establishes that the vulnerabilities meet its KEV criteria: a CVE identifier, evidence of exploitation and clear mitigation guidance. The agency’s notice does not identify the operators, targets or campaigns behind that activity.

Products, versions and federal deadlines

The Plex version information requires particular care. NVD’s affected-version fields list releases below 1.43.0.10861, while the descriptions for all four CVEs say Plex Media Server versions before 1.43.3.10861 are affected. Operators should therefore use Plex’s vendor guidance to determine the applicable update rather than relying on the conflicting NVD threshold alone.

How the four Plex vulnerabilities work

Two of the Plex issues are server-side request forgery flaws.

CVE-2026-96652, classified as CWE-918, affects /player/timeline. According to NVD, a request containing any X-Plex-Token value can use a full URL in the protocol parameter to make the server send a POST request to a selected destination. Its CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

CVE-2026-96655, also CWE-918, allows an authenticated user to make Plex request internal or external addresses through the path parameter associated with /video/:/transcode/universal. It has the same 4.3 score and privilege-required vector as CVE-2026-96652.

CVE-2026-96654 concerns inadequate neutralization of URL values in searchOne. An attacker can use it to invoke functions exposed by other plugins while supplying chosen parameters. NVD scores it 6.5 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, meaning the individual flaw is remotely reachable without privileges or user interaction.

The most severe Plex entry by NVD score is CVE-2026-96656, at 7.2. An administrator can write arbitrary files that may subsequently execute. The TranscoderH264Options preference is inserted verbatim into the x264 options used during transcoding, while .so files are loaded at startup without signature, execute-bit or symbol checks. The individual vulnerability requires high privileges, according to its vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

A news report credits researcher Zach Main with finding the four issues and describes them collectively as Plex2Shell. The report says they can be chained to obtain unauthenticated remote code execution. That chain is a researcher claim relayed by the publication; the individual NVD entries specify a mixture of no-, low- and high-privilege requirements and do not themselves demonstrate the complete chain.

SiteGuard and Siemens flaws enable privileged code execution

SiteGuard Server Edition’s CVE-2026-106931 is an OS command-injection vulnerability classified as CWE-78. Successful exploitation can run arbitrary commands with root or SYSTEM privileges on the host where the product operates.

Unlike the Plex flaws, its CVSS vector—CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H—requires local access and low privileges. The potential impact on confidentiality, integrity and availability is rated high.

The Siemens issue, CVE-2026-110936, affects every Siemens Software Center release below V4.0.9.8. The application searches an uncontrolled path when loading dynamic-link libraries. An authenticated local attacker with high privileges can place a crafted DLL in a searched directory and obtain code execution under the application’s privileges. It is classified as CWE-427 and has the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Secondary reporting associates the Siemens flaw with ClickFix activity involving a platform called Romulus. The same report cites boredhackerblog for claims that attackers have used the Plex flaws to install cryptocurrency miners and proxy malware, and says EG Secure Solutions confirmed exploitation of the SiteGuard issue. CISA’s alert establishes exploitation for KEV inclusion but does not attribute those specific campaigns or payloads.

Required response and triage

For all six vulnerabilities, CISA directs agencies to apply vendor-provided mitigations, comply with BOD 26-04, Prioritizing Security Updates Based on Risk, and follow its “Forensics Triage Requirements.” For cloud services, agencies must follow the applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable.

BOD 26-04 applies to Federal Civilian Executive Branch agencies. It requires them to prioritize KEV vulnerabilities on publicly exposed assets where exploitation can provide total control, while also checking whether a system may have been compromised before remediation. CISA encourages other organizations to adopt the same risk-based prioritization.

The immediate federal deadlines are 2026-10-23 for CVE-2026-96654, CVE-2026-96656 and CVE-2026-106931. CVE-2026-96652, CVE-2026-96655 and CVE-2026-110936 must be remediated by 2026-11-03. Operators outside the federal government should inventory affected installations, assess internet exposure, apply vendor instructions and perform pre-patch compromise checks rather than treating an update alone as sufficient.