Story · 7 sources · 7 articlesfirst Oct 19, 04:14 UTCupdated Oct 21, 18:34 UTC (1d ago)

CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers

criticalExploit / PoCexploited in the wildimportance 90CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656 CVE-2026-110936 CVE-2026-106931 CVE-2026-96651

Merged summary · from the lead article

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are actively exploiting four vulnerabilities in Plex Media Server. The security issues are collectively called Plex2Shell. When chained in an exploit, an attacker can obtain the owner's admin token and execute code with elevated privileges. Plex Media Server is a popular media suite that helps users…

Coverage timelineoldest first · each row is one article

Oct 19, 04:14 UTC · 3d ago
Cyber Security News· 43
Hackers Exploiting Plex Vulnerabilities in the Wild to Deploy Cryptominer Malware
Oct 19, 12:44 UTC · 3d ago
SecurityWeek· 83
Plex2Shell Exploit Chain Weaponized Against Plex Servers Hours After Disclosure
Oct 19, 13:36 UTC · 3d ago
Hacker News · security· 81
Plex vulnerabilities being exploited in the wild to drop a cryptominer
Oct 19, 17:32 UTC

Vulnerabilities in this storyAll →

CVE-2026-1069318.51%
OS command injection in SiteGuard Server Edition
published 8d ago· EG Secure Solutions SiteGuard Server Edition KEV
CVE-2026-1109368.4

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-106931	OS command injection in SiteGuard Server Edition SiteGuard Server Edition has an OS command injection flaw (CWE-78) that lets an attacker run arbitrary operating-system commands. The published CVSS 4.0 vector rates the attack as local, low complexity, and requiring only low privileges, with no user interaction, and with high impact to confidentiality, integrity, and availability on the host. Successful exploitation can yield command execution as root on Unix-like systems or as SYSTEM on Windows. The product is a host-based web application firewall, so affected systems are servers where SiteGuard Server Edition is installed; specific version ranges are not given in the advisory data. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Treat this as a local privilege-escalation issue: apply the vendor's SiteGuard Server Edition security update as soon as a fixed build is published, and until then limit who can run or interact with the product to trusted administrators. Review local accounts and host logs for unexpected OS command execution under the SiteGuard process, and do not expose management or shell access on the host more broadly than necessary.	8.5	1%	KEV	EG Secure Solutions SiteGuard Server Edition	—	8d ago KEV Oct 20, 2026
CVE-2026-110936	DLL Search-Path Hijacking in Siemens Software Center Siemens Software Center, in all versions, loads dynamic-link libraries from an uncontrolled search path (CWE-427). An authenticated local attacker who already has high privileges can place a crafted DLL in a directory the application searches, so the program loads that library. Successful exploitation runs arbitrary code with the privileges of Siemens Software Center and can fully compromise confidentiality, integrity, and availability on that system. The issue is local only: it requires high privileges, no user interaction, and does not extend impact to other systems under the published CVSS 4.0 score of 8.4. It is not listed in CISA KEV, and no public proof-of-concept is known. Do: Treat every installed copy of Siemens Software Center as affected until Siemens publishes a fixed build, and apply that update as soon as it is available. Until then, limit who can write to directories the application searches for DLLs, run the software only with the least privilege required, and review local accounts that already have high privileges on engineering workstations.	8.4	<1%	KEV	Siemens Software Center All versions	—	7d ago KEV Oct 20, 2026
CVE-2026-96656 +4 related CVEs CVE-2026-96654 CVE-2026-96652 CVE-2026-96655 CVE-2026-96651	Admin-Triggered Arbitrary File Write & RCE in Plex Media Server CVE-2026-96656 is an arbitrary file write vulnerability in Plex Media Server versions prior to 1.43.3.10861. The flaw is triggered via the 'TranscoderH264Options' preference, which is appended verbatim to x264's command-line options, allowing an admin user to inject parameters. This can be combined with the server's behavior of loading all .so files at startup without signature, execute-bit, or symbol checks, potentially leading to remote code execution. The vulnerability is rated as high severity (CVSS 8.6) and requires administrative access to exploit. There are no known public exploits or active exploitation reports as of now. Do: Upgrade Plex Media Server to version 1.43.3.10861 or later immediately. Review the 'TranscoderH264Options' setting in your server configuration for any unexpected or suspicious content. Audit any custom .so files or shared libraries placed in the Plex installation directories.	8.6 group max	<1%	KEV

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-106931

OS command injection in SiteGuard Server Edition

SiteGuard Server Edition has an OS command injection flaw (CWE-78) that lets an attacker run arbitrary operating-system commands. The published CVSS 4.0 vector rates the attack as local, low complexity, and requiring only low privileges, with no user interaction, and with high impact to confidentiality, integrity, and availability on the host. Successful exploitation can yield command execution as root on Unix-like systems or as SYSTEM on Windows. The product is a host-based web application firewall, so affected systems are servers where SiteGuard Server Edition is installed; specific version ranges are not given in the advisory data. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat this as a local privilege-escalation issue: apply the vendor's SiteGuard Server Edition security update as soon as a fixed build is published, and until then limit who can run or interact with the product to trusted administrators. Review local accounts and host logs for unexpected OS command execution under the SiteGuard process, and do not expose management or shell access on the host more broadly than necessary.

8.5

KEV

EG Secure Solutions SiteGuard Server Edition

—

8d ago

KEV Oct 20, 2026

CVE-2026-110936

DLL Search-Path Hijacking in Siemens Software Center

Siemens Software Center, in all versions, loads dynamic-link libraries from an uncontrolled search path (CWE-427). An authenticated local attacker who already has high privileges can place a crafted DLL in a directory the application searches, so the program loads that library. Successful exploitation runs arbitrary code with the privileges of Siemens Software Center and can fully compromise confidentiality, integrity, and availability on that system. The issue is local only: it requires high privileges, no user interaction, and does not extend impact to other systems under the published CVSS 4.0 score of 8.4. It is not listed in CISA KEV, and no public proof-of-concept is known.

Do: Treat every installed copy of Siemens Software Center as affected until Siemens publishes a fixed build, and apply that update as soon as it is available. Until then, limit who can write to directories the application searches for DLLs, run the software only with the least privilege required, and review local accounts that already have high privileges on engineering workstations.

8.4

<1%

KEV

Siemens Software Center All versions

—

7d ago

KEV Oct 20, 2026

CVE-2026-96656

Admin-Triggered Arbitrary File Write & RCE in Plex Media Server

CVE-2026-96656 is an arbitrary file write vulnerability in Plex Media Server versions prior to 1.43.3.10861. The flaw is triggered via the 'TranscoderH264Options' preference, which is appended verbatim to x264's command-line options, allowing an admin user to inject parameters. This can be combined with the server's behavior of loading all .so files at startup without signature, execute-bit, or symbol checks, potentially leading to remote code execution. The vulnerability is rated as high severity (CVSS 8.6) and requires administrative access to exploit. There are no known public exploits or active exploitation reports as of now.

Do: Upgrade Plex Media Server to version 1.43.3.10861 or later immediately. Review the 'TranscoderH264Options' setting in your server configuration for any unexpected or suspicious content. Audit any custom .so files or shared libraries placed in the Plex installation directories.

8.6

group max

<1%

KEV