CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

CISA has added four flaws affecting Plex Media Server—dubbed Plex2Shell—to its Known Exploited Vulnerabilities catalog, alongside two more actively exploited bugs in Siemens Software Center and EG Secure Solutions SiteGuard Server Edition. The Plex issues, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656, can reportedly be chained by an unauthenticated attacker to achieve remote code execution, and researchers say threat actors are already using them to install cryptomining and proxy malware; a fix shipped in Plex Media Server 1.43.3.10861 back in August. Siemens Software Center's CVE-2026-110936 is being abused via DLL sideloading in ClickFix-style attacks through a tool called Romulus, while SiteGuard's CVE-2026-106931 is a confirmed-exploited command injection flaw with no further technical details disclosed. Federal civilian agencies must remediate CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654 by October 23, 2026, with the remaining vulnerabilities due by November 3, 2026.