CISA Warns of Active Exploitation of Plex2Shell and Other Flaws
Summary
CISA warned of active exploitation of Plex2Shell flaws and added vulnerabilities in Siemens Software Center and SiteGuard to its KEV catalog. The article reports affected versions, exploitation context, and patch guidance.
Key points
- Plex2Shell chains four Plex Media Server flaws to obtain an owner's admin token and execute code with elevated privileges; the full chain was rated critical by the researcher.
- CISA directed federal agencies to prioritize patching affected Plex systems or apply mitigations by October 23; Plex version 1.43.3.10861, released August 4, addresses the flaws.
- Reports of Plex2Shell exploitation emerged October 17, initially targeting Plex honeypots to deploy a cryptominer.
- CISA added Siemens Software Center flaw CVE-2026-110936 to KEV; Siemens said it was used in campaigns linked to the Romulus ClickFix delivery platform and advised updating to version 4.0.9.8 or later.
- CISA also added actively exploited SiteGuard Server Edition flaw CVE-2026-106931 to KEV; the vendor recommended specified product updates.
Article Details
- Event Type
- CISA warning of active exploitation of vulnerabilities affecting Plex Media Server, Siemens Software Center, and SiteGuard Server Edition.
- Impact
- The Plex2Shell exploit chain can obtain a Plex server owner's admin token and execute code with elevated privileges; reports described attacks deploying a cryptominer to Plex honeypots. The Siemens and SiteGuard flaws were also reported as actively exploited. CISA directed federal agencies to patch or mitigate Plex2Shell-affected systems by October 23.
MITRE ATT&CK
CVE
CVE-2026-106931CISA has also added CVE-2026-106931 to KEV, an OS command injection flaw that affects affecting the SiteGuard Server Edition web application firewall (WAF).CVE-2026-110936Alongside Plex2Shell, CISA has added to its catalog of Known Exploited Vulnerabilities (KEV) an uncontrolled search path element flaw, tracked as CVE-2026-110936, in Siemens Software Center (SSC).CVE-2026-96652CVE-2026-96652 – An SSRF flaw in /player/timeline that allows unauthenticated attackers to make Plex send POST requests to arbitrary destinations, including its own internal APIs.CVE-2026-96654CVE-2026-96654 – A URL injection flaw in searchOne that allows attackers to invoke other plugins’ functions with attacker-controlled parameters.CVE-2026-96655CVE-2026-96655 – An authenticated SSRF flaw in the transcoder endpoint that allows users to make Plex request arbitrary internal or external addresses.CVE-2026-96656CVE-2026-96656 – An arbitrary file write flaw in the transcoder settings that allows administrators to plant malicious shared libraries that Plex subsequently loads, leading to code execution.
People
Vendors
Products
Plex Media ServerCybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server.Siemens Software CenterHackers also target Siemens Software CenterSiteGuard Server EditionCISA has also added CVE-2026-106931 to KEV, an OS command injection flaw that affects affecting the SiteGuard Server Edition web application firewall (WAF).