CISA has added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities catalog, collectively tracking them as Plex2Shell. Security researcher Zach Main found that chaining the four flaws—two server-side request forgery issues, an improper URI scheme neutralization bug, and an external file name or path control flaw—could let a remote attacker achieve unauthenticated code execution. Plex addressed the issues in version 1.43.3.10861, released on August 3, 2026.
Separately, CISA flagged two other actively exploited vulnerabilities: a DLL sideloading flaw in Siemens Software Center (CVE-2026-110936) that has been abused in ClickFix attacks using a platform called Romulus, and a command injection bug in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) that the Japanese company confirmed as exploited. Researcher boredhackerblog reported that the Plex flaws are being weaponized to drop cryptocurrency miners and proxy malware.
CISA is requiring Federal Civilian Executive Branch agencies to apply fixes for CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 by October 23, 2026, and the remaining listed vulnerabilities by November 3, 2026. No additional details on the Siemens and SiteGuard exploitation activity are currently available.