CISA is urging Federal Civilian Executive Branch (FCEB) agencies to apply fixes for three vulnerabilities by October 23, 2026, and to remediate the remaining newly listed flaws by November 3, 2026.
Four "Plex2Shell" flaws added to the Known Exploited Vulnerabilities catalog
The Cybersecurity and Infrastructure Security Agency (CISA) added four Plex Media Server vulnerabilities — collectively labeled "Plex2Shell" — to its Known Exploited Vulnerabilities (KEV) catalog. The four entries and their CVSS scores are:
- CVE-2026-96652 (CVSS 5.3) — Plex Media Server Server-Side Request Forgery (SSRF)
- CVE-2026-96654 (CVSS 6.9) — Plex Media Server improper neutralization of encoded URI schemes in a web page
- CVE-2026-96655 (CVSS 5.3) — Plex Media Server Server-Side Request Forgery (SSRF)
- CVE-2026-96656 (CVSS 8.6) — Plex Media Server external control of file name or path
Security researcher Zach Main, who discovered and reported the vulns, said a remote attacker could chain the four issues to achieve unauthenticated remote code execution. Plex addressed the defects in Plex Media Server 1.43.3.10861, released on August 3, 2026.
Observed weaponization: cryptocurrency miners and proxy malware
CISA’s catalog action follows reporting by security researcher boredhackerblog that threat actors have been weaponizing the Plex2Shell flaws. According to that report, attackers are using the chain to deploy cryptocurrency miners and proxy malware — demonstrating that the vulnerabilities are not merely theoretical but are actively producing malicious payloads in the wild.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogTwo other actively exploited flaws: Siemens DLL sideloading and SiteGuard command injection
The agency also flagged two non-Plex vulnerabilities as actively exploited. The first is a DLL sideloading issue in Siemens Software Center, CVE-2026-110936 (CVSS 8.4). CISA noted the flaw has been abused in ClickFix attacks using a platform called Romulus.
The second is a command injection vulnerability in EG Secure Solutions SiteGuard Server Edition, CVE-2026-106931 (CVSS 8.5). According to the bulletin, the Japanese company confirmed that the SiteGuard flaw is being exploited; the advisory states no additional details about the exploitation activity are currently available.
Deadlines for federal agencies and the specific fixes required
CISA’s advisory assigns near-term deadlines for Federal Civilian Executive Branch agencies. Agencies are urged to apply fixes for CVE-2026-106931 (SiteGuard), CVE-2026-96656 (Plex external control of file name or path), and CVE-2026-96654 (Plex encoded URI schemes) by October 23, 2026. The remainder of the newly listed vulnerabilities — including CVE-2026-96652 and CVE-2026-96655 — are to be remediated by November 3, 2026.
The KEV listing formalizes these entries as exploited vulnerabilities that CISA sees as requiring government attention within the specified windows.
What this means for FCEB agencies, Plex operators, and threat actors
- Federal Civilian Executive Branch (FCEB) agencies: must apply the specified fixes for CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 by October 23, 2026, and complete remediation of the rest of the newly listed vulnerabilities by November 3, 2026.
- Plex Media Server operators and technologists: should confirm they are running Plex Media Server 1.43.3.10861 (released August 3, 2026), the version in which the Plex2Shell issues were addressed, and verify that chained exploitation paths are mitigated in their environments.
- Threat actors and malware operators: the public reporting by boredhackerblog and the KEV additions indicate active weaponization — specifically deployment of cryptocurrency miners and proxy malware — and continued abuse of DLL sideloading via Romulus-style ClickFix activity.
The immediate, specific deadlines set by CISA put remediation on a compressed timetable for agencies and affected operators alike. With researcher disclosures, a vendor patch release, and reports of active weaponization all on the record, the next measure of consequence will be whether the required fixes are applied before adversaries expand their current campaigns. For the original reporting, see the Hacker News summary at the link below.
https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html
