Plex2Shell Chain Leads Six Actively Exploited Flaws on CISA's Urgent Patch List

On October 20, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after finding evidence that attackers are already using them. Four of the bugs affect Plex Media Server, the popular software people use to stream their own video and music libraries. Together, these four are known as "Plex2Shell", and the most severe is tracked as CVE-2026-96656. The other two affect EG Secure Solutions SiteGuard Server Edition and Siemens Software Center. Federal civilian agencies must patch the most urgent three by October 23.

What happened

CISA's KEV catalog lists security holes that are confirmed to be exploited in real attacks, not just in theory. Adding a flaw to the list is a signal to defenders that it should move to the top of the to-do list.

The sequence of events, as described in the source material, runs as follows:

1. Security researcher Zach Main discovered and reported four Plex Media Server vulnerabilities. According to his findings, a remote attacker could link them together to run code on a Plex server without logging in.
2. Plex fixed all four issues in Plex Media Server version 1.43.3.10861, released on August 3, 2026.
3. A security researcher using the name boredhackerblog later reported that threat actors were using the flaws to install cryptocurrency miners and proxy malware on vulnerable servers.
4. On October 20, CISA added the four Plex bugs to the KEV catalog. It also added a command injection flaw in SiteGuard Server Edition and a search path flaw in Siemens Software Center.

The six entries are:

• CVE-2026-96652: Plex Media Server server-side request forgery (SSRF)
• CVE-2026-96654: Plex Media Server improper neutralization of encoded URI schemes
• CVE-2026-96655: Plex Media Server server-side request forgery (SSRF)
• CVE-2026-96656: Plex Media Server external control of file name or path
• CVE-2026-106931: EG Secure Solutions SiteGuard Server Edition OS command injection
• CVE-2026-110936: Siemens Software Center uncontrolled search path element

The reporting is inconsistent on one point. The Hacker News article opens by saying CISA added "four" vulnerabilities, then goes on to describe all six. CISA's own alert clearly states that six were added.

Who is affected

Plex Media Server: Every version before 1.43.3.10861 is vulnerable to all four Plex2Shell bugs, according to verified CVE records. Plex is widely used by home users and hobbyists, so many exposed servers may sit on home networks rather than in corporate data centres.

SiteGuard Server Edition: This product comes from EG Secure Solutions, which The Hacker News describes as a Japanese company. The ITVedas CVE database entry lists FreeBSD alongside SiteGuard as affected, which suggests at least FreeBSD-based deployments are in scope. The sources do not list specific vulnerable or fixed version numbers.

Siemens Software Center: The sources name the product but give no version details.

U.S. federal agencies: Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to fix KEV-listed flaws on a set schedule. CISA also urges private organisations to treat the catalog as a priority list.

How it works

This section explains the flaws in plain terms. It deliberately leaves out any details that could help someone carry out an attack.

The Plex2Shell chain

Each of the four Plex bugs is limited when used alone. The danger comes from combining them, which is known as "chaining."

• SSRF flaws (CVE-2026-96652 and CVE-2026-96655): Server-side request forgery means an attacker can trick a server into sending web requests to addresses the attacker chooses. These can include internal systems the attacker could not reach directly. The CVE records say one of these bugs works with any Plex access token value. The other requires an authenticated user.
• Encoded URI flaw (CVE-2026-96654): Plex does not properly clean up web addresses supplied to one of its search functions. As a result, an attacker can call functions belonging to other Plex plugins and pass in their own settings.
• File path flaw (CVE-2026-96656): The verified record states that an admin-level user can write arbitrary files that may later run when Plex loads them. Part of the problem is that a transcoding preference is passed through without checks. In addition, at startup Plex loads library files without checking signatures or other safeguards.

Some of these bugs on their own require authentication or admin rights. According to Zach Main, though, chaining them lets a remote attacker reach code execution without any login at all. This is what gives "Plex2Shell" its name: the end result is a shell, or command access, on the server.

SiteGuard command injection

OS command injection (CWE-78) happens when software passes attacker-controlled input into operating system commands. The verified record says exploiting CVE-2026-106931 could let an attacker run arbitrary commands with root or SYSTEM privileges. Those are the highest levels of control on Unix-like and Windows systems.

Siemens DLL sideloading

CVE-2026-110936 is an "uncontrolled search path" weakness, which The Hacker News describes as DLL sideloading. In simple terms, the program searches for a supporting code file (a DLL) in places an attacker can influence. This lets malicious code load in place of the real file. The outlet reports that the bug has been abused in ClickFix attacks using a platform called Romulus.

How serious is it?

All six flaws are confirmed as exploited. The verified CVE data and The Hacker News agree on the scores they both cover:

• CVE-2026-96656 (Plex): 8.6, High
• CVE-2026-106931 (SiteGuard): 8.5, High
• CVE-2026-110936 (Siemens): 8.4, according to The Hacker News (not present in our verified dataset)
• CVE-2026-96654 (Plex): 6.9, Medium
• CVE-2026-96652 and CVE-2026-96655 (Plex): 5.3, Medium each

The Medium scores for some Plex bugs can be misleading. CVSS rates each flaw on its own, but attackers are combining them into an unauthenticated remote takeover. The reported attacks, which install crypto miners and proxy malware, turn hijacked servers into resources for criminals. CISA itself calls these classes of bugs "a frequent attack vector for malicious cyber actors."

CISA's deadlines show how it ranks the risk. FCEB agencies must fix CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by October 23, 2026. The remaining three are due by November 3, 2026. BOD 26-04 also sets expectations for when agencies must check whether attackers got in before the patch was applied.

What to do now

For administrators

• Upgrade every Plex Media Server instance to version 1.43.3.10861 or later.
• Take Plex servers that cannot be updated right away off the public internet.
• Check Plex hosts for signs of compromise, such as unexpected CPU load from crypto miners, unknown processes, unfamiliar proxy traffic, or unexpected library files in Plex directories.
• Apply EG Secure Solutions' fix for SiteGuard Server Edition (CVE-2026-106931), especially on internet-facing systems. Treat any unpatched exposure as a possible root-level compromise.
• Apply Siemens' update for Software Center (CVE-2026-110936), and alert staff to ClickFix-style social engineering.
• Federal agencies should meet the October 23 and November 3 deadlines and follow the compromise-check requirements in BOD 26-04.

For everyday users

• If you run Plex at home, open the server settings and confirm you are on 1.43.3.10861 or newer. Turn on automatic updates if available.
• Avoid exposing your Plex server directly to the internet unless you need to.
• Watch for a home server or PC that suddenly runs hot, slow or noisy. This can be a sign of cryptocurrency mining malware.
• Never paste commands into your computer because a website or pop-up tells you to.

What we still don't know

• How many Plex servers have been compromised, and when exploitation began relative to the August 3 patch.
• Which SiteGuard and Siemens Software Center versions are affected or fixed.
• Who is behind the SiteGuard attacks. The Hacker News says no further details are available.
• Who operates the Romulus platform and how widely the Siemens flaw has been abused.
• Whether the attacks have targeted particular sectors or regions.

ITVedas analysis: Plex2Shell shows how a handful of medium-rated bugs can add up to a full server takeover. Scoring each flaw on its own badly understates the risk. Plex fixed the chain more than two months before CISA's listing, so home-lab and small-office servers that still lag behind are now easy targets for low-effort crypto-mining gangs.