CISA KEV Catalog Updated with Six Actively Exploited Flaws
CISA Adds Six Flaws to KEV Catalog, Including Plex2Shell Chain
CVE Identifiers
Full Report
Executive Summary
On October 20, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating reliable evidence of active exploitation in the wild. This action, under Binding Operational Directive (BOD) 22-01, mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these flaws by specified deadlines. The most prominent additions are four vulnerabilities in Plex Media Server, dubbed "Plex2Shell," which can be chained to achieve unauthenticated remote code execution. The other two flaws affect Siemens Software Center and EG Secure Solutions SiteGuard Server Edition. CISA strongly urges all organizations to prioritize patching these vulnerabilities to defend against active threats.
Vulnerabilities Addressed
The six vulnerabilities added to the KEV catalog are:
Plex2Shell Attack Chain: A series of four vulnerabilities in Plex Media Server that, when chained, allow unauthenticated RCE. Attackers are reportedly using this chain to deploy cryptocurrency miners and proxy malware.
- CVE-2026-96652: Server-Side Request Forgery (SSRF) - CVSS 5.3
- CVE-2026-96654: Improper Neutralization of Special Elements used in a URI Scheme - CVSS 6.9
- CVE-2026-96655: Server-Side Request Forgery (SSRF) - CVSS 5.3
- CVE-2026-96656: External Control of File Name or Path (Path Traversal) - CVSS 8.6
Siemens Software Center Vulnerability:
- CVE-2026-110936: Uncontrolled Search Path Element (DLL Sideloading) - CVSS 8.4. This flaw can be abused for privilege escalation and persistence.
EG Secure Solutions Vulnerability:
- CVE-2026-106931: OS Command Injection - CVSS 8.5. This critical flaw in SiteGuard Server Edition allows an attacker to execute arbitrary commands with root or SYSTEM privileges.
Affected Products
- Plex Media Server: Versions prior to
1.43.3.10861(patched on August 3, 2026). - Siemens Software Center: All versions.
- EG Secure Solutions SiteGuard Server Edition: Specific versions affected, patch required.
Impact Assessment
Exploitation of these vulnerabilities can lead to severe consequences:
- Plex2Shell: Full compromise of the server running Plex Media Server. This can lead to data theft from the host system, its use in botnets, or as a pivot point into the internal network. The observed deployment of cryptominers indicates a direct financial motive.
- Siemens Software Center: Local privilege escalation on systems where the software is installed. An attacker with initial low-privilege access could use this to gain SYSTEM-level control.
- EG Secure Solutions: Complete takeover of the SiteGuard server, as the command injection runs with the highest privileges. This could disable security protections and allow attackers to control web traffic.
The inclusion in the KEV catalog confirms that these are not theoretical risks; threat actors are actively weaponizing them. Organizations that have not patched are at a high and immediate risk of compromise.
Deployment Priority
Under BOD 22-01, federal agencies have strict deadlines:
- By October 23, 2026: Patch
CVE-2026-106931(EG Secure),CVE-2026-96652(Plex), andCVE-2026-96654(Plex). - By November 3, 2026: Patch
CVE-2026-96655(Plex),CVE-2026-96656(Plex), andCVE-2026-110936(Siemens).
CISA recommends all organizations adopt a similar risk-based prioritization schedule. Internet-facing systems, such as Plex Media Servers and SiteGuard appliances, should be treated as the highest priority.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
/photo/:/transcode?url=Plex Media Server.execmd.exe, powershell.exe, or cryptominer executables.C:\Program Files (x86)\Siemens\Software Center\Plex Media Server LogsDetection Methods
- Asset Inventory & Scanning: First, identify all instances of the affected software in your environment. Use authenticated vulnerability scans to confirm vulnerable versions.
- EDR and Process Monitoring: For Plex2Shell, monitor the
Plex Media Serverprocess for outbound network connections to unexpected destinations or the creation of suspicious files and processes. For the Siemens flaw, use EDR to detect DLL sideloading by monitoring for processes loading DLLs from non-standard directories. Reference D3FEND techniqueProcess Analysis. - Network Monitoring: For the Plex SSRF flaws, monitor web logs for requests to the vulnerable endpoints containing internal or unexpected external IP addresses. For the EG Secure flaw, monitor for unusual outbound connections from the appliance. Reference D3FEND technique
Network Traffic Analysis.
Remediation Steps
- Apply Patches: The primary remediation is to apply the security updates provided by the respective vendors. For Plex, update to version
1.43.3.10861or later. Contact Siemens and EG Secure Solutions for their specific patch guidance. Reference D3FEND Hardening techniqueSoftware Update. - Restrict Access: For internet-facing systems like Plex, ensure they are not unnecessarily exposed. Restrict access to trusted IP addresses if possible. Do not expose the management interface to the public internet.
- Harden Configurations: For the Siemens DLL sideloading flaw, ensure that application directories have proper permissions to prevent unauthorized users from writing malicious DLLs. Reference D3FEND Hardening technique
Local File Permissions. - Review KEV Catalog Regularly: Incorporate CISA's KEV catalog into your vulnerability management program to prioritize patching efforts based on active threats.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
Applying vendor patches is the most effective way to remediate all six vulnerabilities.
Mapped D3FEND Techniques:
Enable comprehensive logging on affected systems to detect exploitation attempts and post-compromise activity.
Restrict network access to internet-facing applications like Plex Media Server to only trusted IP ranges.
Mapped D3FEND Techniques:
D3FEND Defensive Countermeasures
The primary countermeasure is to adhere to a strict patch management cycle guided by threat intelligence like the CISA KEV catalog. For the Plex2Shell flaws, administrators must immediately update Plex Media Server to version 1.43.3.10861 or newer. Similarly, patches from Siemens and EG Secure Solutions must be deployed. Organizations should use asset management and vulnerability scanning tools to identify all affected instances and automate patch deployment where possible. The KEV designation signifies an active and present danger, elevating the urgency of these updates above routine patching. Verification scans should be conducted post-deployment to confirm successful remediation across the entire environment.
To detect exploitation of the Plex2Shell SSRF vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655), security teams should implement network traffic analysis focused on web server logs and netflow data. Specifically, monitor for inbound requests to Plex servers targeting the /photo/:/transcode endpoint where the url parameter contains unexpected values, such as localhost addresses (127.0.0.1), internal RFC1918 IP addresses, or URLs pointing to external, non-Plex domains. Furthermore, monitor for unusual outbound connections from the Plex server itself, as this could indicate a successful SSRF callback or post-compromise C2 communication. Baselining normal traffic patterns for the Plex server is essential to quickly identify these anomalous connections.
To counter the post-exploitation impact of attacks like Plex2Shell, which deploy unauthorized software like cryptocurrency miners, organizations should implement application control or executable allowlisting on servers. On a dedicated system like a Plex Media Server, the set of required executables is typically small and predictable. By creating a policy that only allows known, legitimate executables to run (e.g., Plex Media Server.exe and standard OS binaries), the execution of dropped malware would be blocked. This defense-in-depth measure is highly effective at preventing attackers from achieving their objectives even if they successfully exploit a vulnerability to gain initial code execution.
Timeline of Events
Plex patches the vulnerabilities that would later be known as the Plex2Shell chain in version 1.43.3.10861.
CISA adds six vulnerabilities, including the Plex2Shell flaws, to its KEV catalog.
Deadline for US federal agencies to patch CVE-2026-106931, CVE-2026-96652, and CVE-2026-96654.
Deadline for US federal agencies to patch CVE-2026-96655, CVE-2026-96656, and CVE-2026-110936.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.