CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

CISA’s Known Exploited Vulnerabilities, or KEV, catalog tracks software flaws that are being exploited in real attacks. This separates confirmed threats from vulnerabilities that are only potential risks. A catalog entry signals that defenders should treat the flaw as an immediate security concern.

In this alert, CISA added four Plex Media Server vulnerabilities to the catalog. The additions followed a report that attackers were using the flaws to deploy cryptocurrency miners and proxy malware. Two other exploited flaws affected Siemens Software Center and EG Secure Solutions SiteGuard Server Edition.

For Federal Civilian Executive Branch agencies, a KEV listing creates a firm remediation deadline. CISA told agencies to fix three vulnerabilities by October 23, 2026, and the remaining flaws by November 3, 2026. The article does not state the specific reason for assigning different deadlines, but it shows that CISA set separate deadlines for the vulnerabilities.

The alert names three affected products. Plex Media Server had four vulnerabilities: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. CISA also flagged CVE-2026-110936 in Siemens Software Center and CVE-2026-106931 in EG Secure Solutions SiteGuard Server Edition.

The Plex issues include two server-side request forgery flaws, improper neutralization of encoded URI schemes, and external control of a file name or path. The Siemens issue is a DLL sideloading vulnerability. The SiteGuard flaw is a command injection bug. These technical categories describe different ways attackers can influence software behavior.

Security researcher boredhackerblog reported that threat actors were weaponizing the Plex flaws to deploy cryptocurrency miners and proxy malware. The Siemens vulnerability was abused in ClickFix attacks using Romulus. EG Secure Solutions confirmed exploitation of its SiteGuard flaw, but the article gives no additional exploitation details.

Four vulnerabilities make up Plex2Shell. They affect Plex Media Server and carry the identifiers CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Their CVSS scores range from 5.3 to 8.6, with the path-related vulnerability receiving the highest score.

The alert mentions two additional software flaws outside Plex2Shell. CVE-2026-110936 affects Siemens Software Center and has a CVSS score of 8.4. CVE-2026-106931 affects EG Secure Solutions SiteGuard Server Edition and has a CVSS score of 8.5.

Therefore, the alert covers six vulnerabilities in total: four Plex vulnerabilities plus two flaws in other products. CISA added the four Plex issues to its KEV catalog and also flagged the Siemens and SiteGuard vulnerabilities as actively exploited. The article describes exploitation activity for each group, although details differ.

The most serious consequence is unauthenticated remote code execution. That means a remote attacker may be able to make the Plex server run malicious commands without first logging in. The result is more severe than simply viewing data or causing a limited service failure.

The attack depends on chaining four separate weaknesses. The two SSRF flaws can make the server send requests, while the encoded URI issue can affect how web requests are handled. The file-name or path vulnerability can give the attacker control over where a file is accessed or placed. Together, these weaknesses can form a route to code execution.

This is not only a theoretical risk. Researcher boredhackerblog found that threat actors were weaponizing the flaws to deploy cryptocurrency miners and proxy malware. Plex addressed the vulnerabilities in version 1.43.3.10861, released August 3, 2026, but exposed systems still require attention.

The required patching audience is the Federal Civilian Executive Branch, or FCEB. CISA urged these agencies to apply fixes for CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 by October 23, 2026. Those agencies must address the remaining vulnerabilities by November 3, 2026.

The earlier deadline covers the SiteGuard command injection flaw and two Plex vulnerabilities. The later deadline covers the other vulnerabilities listed in the alert, including the remaining Plex issues and the Siemens Software Center flaw. This creates a clear sequence for federal remediation.

The source does not state why CISA selected different dates. It only reports that CISA assigned the three named vulnerabilities the earlier deadline and all others the later one. The different dates therefore show separate agency priorities, but the article provides no further explanation of the criteria behind them.

Server-side request forgery, or SSRF, tricks a server into sending requests chosen by an attacker. Because the request comes from the server, it may reach locations the attacker cannot access directly. Path manipulation changes a file name or path so software reads, writes, or uses an unintended location.

DLL sideloading abuses how an application finds a dynamic-link library. An attacker places a malicious library where the legitimate program will load it. Command injection happens when untrusted input is inserted into an operating-system command, allowing the attacker’s instructions to run with the application’s permissions.

These weaknesses do not all have the same effect, but each can undermine a trust boundary. The article identifies SSRF and path-control flaws in Plex, DLL sideloading in Siemens Software Center, and command injection in SiteGuard. It specifically reports that chaining the Plex flaws can enable unauthenticated remote code execution.

A vulnerability being actively exploited is an immediate operational threat. Attackers have already discovered how to use it, and defenders may be facing attacks while the flaw remains unpatched. A theoretical vulnerability may still be serious, but its practical attack path has not been confirmed in the reported activity.

The Plex case shows the difference clearly. Threat actors were reportedly weaponizing the flaws to deploy cryptocurrency miners and proxy malware. The Siemens vulnerability was abused in ClickFix attacks, and the company behind SiteGuard confirmed exploitation of its command injection flaw.

Those reports give organizations concrete reasons to move quickly. Patching an exploited flaw can interrupt an attack path already being used, while waiting increases exposure. CISA’s KEV catalog highlights this urgency and gives FCEB agencies specific deadlines. The article does not claim that unexploited flaws are harmless; it shows that confirmed exploitation changes the priority.