The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that’s collectively called Plex2Shell.
The vulnerabilities are listed below –
- CVE-2026-96652 (CVSS score: 5.3) – Plex Media Server Server-Side Request Forgery (SSRF) vulnerability
- CVE-2026-96654 (CVSS score: 6.9) – Plex Media Server improper neutralization of encoded URI schemes in a web page Vulnerability
- CVE-2026-96655 (CVSS score: 5.3) – Plex Media Server Server-Side Request Forgery (SSRF) vulnerability
- CVE-2026-96656 (CVSS score: 8.6) – Plex Media Server external control of file name or path Vulnerability
According to security researcher Zach Main, who discovered and reported the vulnerabilities, a remote attacker could chain the four vulnerabilities to achieve unauthenticated remote code execution. The issues were addressed in Plex Media Server 1.43.3.10861 released on August 3, 2026.
The addition of the four vulnerabilities to the KEV catalog follows a report from security researcher boredhackerblog, who found that threat actors are weaponizing the flaws to deploy cryptocurrency miners and proxy malware.
CISA has also flagged two other vulnerabilities as actively exploited. One of them is a DLL sideloading vulnerability in Siemens Software Center (CVE-2026-110936, CVSS score: 8.4) that has been abused in ClickFix attacks using a platform called Romulus.
The second security flaw is a command injection bug in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931, CVSS score: 8.5) that the Japanese company confirmed as being exploited. No additional details related to the exploitation activity are currently available.
CISA is urging Federal Civilian Executive Branch (FCEB) agencies to apply fixes for CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 by October 23, 2026, and the rest by November 3, 2026.
