CISA added Plex Media Server, Siemens Software Center and EG Secure Solutions SiteGuard Server Edition flaws to its Known Exploited Vulnerabilities catalog on October 20, 2026, according to The Hacker News.
The Plex set, nicknamed Plex2Shell, is four bugs reported by researcher Zach Main: CVE-2026-96652 (CVSS 5.3, SSRF), CVE-2026-96654 (6.9, improper neutralization of encoded URI schemes), CVE-2026-96655 (5.3, SSRF) and CVE-2026-96656 (8.6, external control of file name or path). Main says a remote attacker can chain all four for unauthenticated remote code execution. Individually the scores look modest. Chained, they are not.
Researcher boredhackerblog reports threat actors are already weaponizing the chain to deploy cryptocurrency miners and proxy malware. Plex fixed the flaws in Media Server 1.43.3.10861, released August 3, 2026. The source does not list affected version ranges.
The other two entries: CVE-2026-110936 (CVSS 8.4) is a DLL sideloading flaw in Siemens Software Center, abused in ClickFix attacks that use a platform called Romulus. CVE-2026-106931 (CVSS 8.5) is a command injection in SiteGuard Server Edition, where the Japanese vendor has confirmed exploitation. No fixed versions or further exploitation detail are public for either.
CISA set a federal civilian deadline of October 23, 2026 for CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654, and November 3, 2026 for the rest.
Why it matters: a home-media product on a corporate or lab network is an easy foothold, and the miner and proxy payloads suggest opportunistic scanning rather than targeted intrusion. Low individual CVSS scores can hide a chain that ends in code execution.
Mitigation: update Plex Media Server to 1.43.3.10861 or later and keep it off the public internet. Inventory Plex instances on managed networks. Check Siemens Software Center and SiteGuard vendor advisories for fixes, and hunt for unexpected DLLs loaded by Software Center and for ClickFix-style execution prompts.
