CISA Lists Plex2Shell and Siemens Vulnerability Exploits

The CISA, the United States cybersecurity agency, included six vulnerabilities in its catalog of actively exploited flaws (KEV) on Tuesday (20), according to the alert published by the agency. Four of them form the chain named Plex2Shell in the Plex Media Server: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. The other two are CVE-2026-110936 in the Siemens Software Center and CVE-2026-106931 in the SiteGuard Server Edition from the Japanese company EG Secure Solutions.

Inclusion in the KEV mandates U.S. federal agencies to patch systems within deadlines set by CISA under directive BOD 22-01. For the private sector, the list serves as a priority queue: CISA only records flaws with evidence of actual exploitation, not just theoretical.

Plex2Shell: From Home Server to Corporate Network

Plex is a media server that millions install at home, on NAS devices or Linux machines, to organize movies and series. Plex2Shell chains four vulnerabilities that, in isolation, would not grant control of the server. Combined in the correct order, they lead from an unauthenticated request to the execution of a binary chosen by the attacker on the server. The chain begins by stealing the admin token of the server owner.

The interval between publication and attack was one day. The proof of concept code became public on October 16, and the first recorded attack on a honeypot occurred on October 17, according to the researcher operating the trap. The installed payloads included the XMRig cryptocurrency miner and a proxy tool that turns the compromised server into an exit point for unauthorized traffic, using the victim's residential connection.

The patch has been available since August. The four vulnerabilities affect versions of Plex Media Server prior to 1.43.3.10861, released on August 3, 2026, and Plex issued guidance urging users to update. The problem lies in the installed base that does not update automatically, typical of home devices.

For the CISO, the problem is about proximity: the Plex server often resides on the same home network as the employee's corporate laptop when working remotely. A compromised server becomes a foothold within that network and, via proxy, allows the attacker's traffic to exit through a legitimate residential IP, making it difficult to block based on reputation. Conditional access tools that trust known residential IPs of an employee may start to observe hostile traffic emanating from the same address.

Siemens and the Abuse of Signed Software

The Siemens vulnerability has a different profile. CVE-2026-110936 is a DLL loading vulnerability in the Siemens Software Center, a tool that distributes and updates the company's software on engineering workstations. An attacker who can place a malicious DLL in a directory that the program queries executes code with the application's privileges. Siemens ProductCERT confirmed active exploitation in a notice dated October 19.

The vector is known and effective: using a legitimate executable, with a valid digital signature, to load malicious code. Security solutions that rely on signed binaries tend to allow the execution to pass through.

The SiteGuard, the third product on the list, is a web application firewall from a Japanese manufacturer. EG Secure Solutions confirmed exploitation in a notice dated October 14.

Where the Risk Falls

In the United States, the effect is direct: federal agencies have deadlines to patch, and government contractors often follow the same schedule due to contractual requirements. In Germany, where the installed base of Siemens engineering software is denser, the alert affects factories and design offices that maintain Windows workstations with broad permissions for industrial tools. In Japan, the flaw in SiteGuard exposes corporate and government websites that adopted the product precisely as a layer of protection.

In Brazil, the point of contact is the industrial chain: automakers, steel mills, and energy companies use Siemens software in plants and engineering centers, often managed by third-party integrators. The risk from Plex2Shell is transversal across these countries because it depends on remote work policies, not sectors.

Tuesday's list shows a pattern that security teams already know yet rarely budget for: two of the three exploited fronts come from software that the IT department neither purchased nor manages. One is installed by employees at home; the other is a distribution tool from the manufacturer itself, treated as trustworthy by definition. Neither appears in the asset inventory that feeds the remediation plan.