CISA KEV Weekly Roundup: 6 Exploited Flaws, 3 Due Today
CISA put six exploited vulnerabilities on its Known Exploited Vulnerabilities list this week, all on Tuesday. Four are Plex Media Server bugs that attackers chain into code execution. One is a Japanese web application firewall that hands out root. The last is a signed Siemens desktop app that a ClickFix crew uses to sideload malware. Three of the six are due today.
What: Six CVEs added to CISA KEV on Tuesday, October 20, 2026: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656 (Plex Media Server, the “Plex2Shell” chain); CVE-2026-106931 (EG Secure Solutions SiteGuard Server Edition); CVE-2026-110936 (Siemens Software Center).
Status: Exploited in the wild, per CISA. No other KEV additions appeared in the catalog data we reviewed for Saturday, October 17 through today.
Deadline: Today, Friday, October 23 for CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654. Tuesday, November 3 for CVE-2026-96652, CVE-2026-96655 and CVE-2026-110936.
Fix: Plex Media Server 1.43.3.10861 or later; SiteGuard Server Edition 8.00 Update 5 (7.00 Update 6 on FreeBSD) or the vendor’s standalone patch; Siemens Software Center 4.0.9.8 or later. Preserve evidence before you patch SiteGuard.
Key takeaways
- CISA added six exploited CVEs to KEV this week, all on October 20. Four are in Plex Media Server, one in SiteGuard Server Edition and one in Siemens Software Center.
- Three federal deadlines land today, October 23: the SiteGuard command injection (CVE-2026-106931) and two of the four Plex bugs (CVE-2026-96656 and CVE-2026-96654). The other three are due November 3.
- Plex2Shell is a chain, so patch all four at once. Plex Media Server 1.43.3.10861 fixes every link. Attackers began hitting servers the day after technical details went public, dropping a cryptominer and a proxy backdoor.
- SiteGuard runs inside the web server it protects. The flaw yields root or SYSTEM. The vendor warns that patching can wipe attack traces, so download its diagnostic bundle first.
- The Siemens flaw is a malware delivery trick, not an industrial-control bug. A ClickFix operation called Romulus ships a genuine, signed Siemens executable with a malicious DLL beside it. Fix with 4.0.9.8 and hunt by behavior, not file hash.
Executive Summary
This week’s KEV list is small, but it sits in places most vulnerability programs don’t watch closely.
Last week’s additions, covered in our October 16 KEV roundup, were classic edge targets: firewalls, an email gateway, a remote-access appliance. This week CISA reached into a media server that staff run at home and in labs, a host-based WAF common in Japan, and a desktop software updater. None of these typically has a named owner in an enterprise patch program. All six are confirmed as exploited.
Plex Media Server accounts for four entries. Researcher Zach Main reported the bugs to Plex in July, a fixed build shipped in early August, and full technical details followed on October 16. Attacks followed within a day. SiteGuard’s maker told its support customers about the command injection on September 29 and published it on October 14; both the vendor and JPCERT/CC say it is being exploited. Siemens says its Software Center app is being abused in ClickFix campaigns run through the Romulus delivery platform.
The bottom line: SiteGuard and Plex hit their federal deadline today. Find every instance, preserve SiteGuard diagnostics, patch, then hunt for the indicators below. Treat Siemens Software Center as an endpoint detection task as much as a patch.
Why This Matters to CISOs and Security Leaders
Shadow servers are the theme. Plex is consumer software, but it shows up on developer workstations, lab networks and home machines that connect to corporate VPNs. Most asset inventories won’t list it. The Plex2Shell chain ends in code execution on the host, so any Plex server that can reach your network is now a foothold risk.
A security control is the target again. SiteGuard is a WAF that installs as a module inside Apache, Nginx or IIS. When the protection layer has a root-level command injection, the web server it guards is compromised with it. This follows the email-gateway and firewall flaws on recent KEV lists, including the Cisco Secure Email Gateway flaw CVE-2026-76519.
Signed does not mean safe. The Siemens case shows attackers reusing a legitimately signed executable to load their own code. Allow-listing by publisher alone would have let it run.
Ask your team one question today: “Can we list every Plex, SiteGuard and Siemens Software Center install we own, including on developer and lab machines?” If the answer takes more than an hour, your exposure is unknown, and three of these flaws are already at their federal deadline.
The Timeline
| Date (2026) | What happened |
|---|---|
| July 27 | Zach Main reports the Plex2Shell flaws to Plex |
| Early August | Plex Media Server 1.43.3.10861 released with fixes (August 3 per The Hacker News, August 4 per BleepingComputer) |
| September 29 | EG Secure Solutions notifies SiteGuard customers with direct support contracts |
| October 14 | SiteGuard public advisory for CVE-2026-106931 |
| October 15 | Siemens publishes SSA-580366 for CVE-2026-110936 (per SOC Prime’s summary) |
| October 16 | Plex2Shell technical details published; a proof of concept follows days later |
| October 17 | First in-the-wild exploitation of Plex2Shell reported |
| October 19 | Siemens confirms CVE-2026-110936 exploitation linked to the Romulus ClickFix platform |
| Tuesday, Oct 20 | CISA adds all six CVEs to KEV |
| Friday, Oct 23 | Federal deadline: CVE-2026-106931, CVE-2026-96656, CVE-2026-96654 |
| Tuesday, Nov 3 | Federal deadline: CVE-2026-96652, CVE-2026-96655, CVE-2026-110936 |
Patches for Plex2Shell existed for more than two months. Attacks started one day after the write-up.
Vulnerability & Exploit Analysis
CVE-2026-106931: SiteGuard Server Edition (due today)
Product: EG Secure Solutions SiteGuard Server Edition, a host-based web application firewall. Flaw: OS command injection (CWE-78) in the statistics function, which reporting says is on by default in host-based deployments. Successful exploitation runs commands as root on Linux and FreeBSD or as SYSTEM on Windows. eSecurity Planet reports a CVSS 4.0 score of 8.5 with a local attack vector, so attackers likely need some foothold on the server first. How they get one has not been disclosed. Due: October 23. First action: download the diagnostic information from the web management screen and store it off-host, then upgrade or apply the vendor’s file-replacement patch. If you can’t do either today, JPCERT/CC’s interim advice is to switch off the statistics function. Our full analysis is in the SiteGuard CVE-2026-106931 briefing.
CVE-2026-96656: Plex Media Server file write (due today)
Flaw: external control of file name or path in transcoder settings. An admin-level session can write files that Plex later loads, which is how the chain turns into code execution. The Hacker News lists it at CVSS 8.6. Due: October 23. First action: upgrade to 1.43.3.10861 or later.
CVE-2026-96654: Plex Media Server URL injection (due today)
Flaw: improper neutralization of encoded URI schemes in searchOne, letting an attacker call other plugins’ functions with its own parameters. CVSS 6.9 per The Hacker News. Due: October 23. First action: same upgrade.
CVE-2026-96652: Plex Media Server SSRF (due Nov 3)
Flaw: server-side request forgery in /player/timeline. CISA says any X-Plex-Token value works, and BleepingComputer describes it as unauthenticated. It forces the server to POST to an attacker-chosen address, including its own internal APIs. CVSS 5.3. Due: November 3. First action: same upgrade. This is the entry point of the chain, so don’t wait for the later deadline.
CVE-2026-96655: Plex Media Server authenticated SSRF (due Nov 3)
Flaw: SSRF through the /video/:/transcode/universal path that lets an authenticated user reach arbitrary internal or external addresses. CVSS 5.3. Due: November 3. First action: same upgrade. We broke the chain down step by step in our Plex2Shell briefing.
CVE-2026-110936: Siemens Software Center (due Nov 3)
Flaw: uncontrolled search path element (CWE-427). The app loads DLLs from its own folder without checking them, so a planted DLL runs with the app’s privileges. CVSS 4.0 score 8.4. Huntress researcher Jose Oregon is credited. Due: November 3. First action: update to 4.0.9.8 or later and confirm the version. Siemens says the update applies when the app starts. Then hunt for the sideloading pattern below.
Affected and fixed versions
| Product | CVE(s) | Vulnerable | Fixed in |
|---|---|---|---|
| Plex Media Server | CVE-2026-96652, -96654, -96655, -96656 | Before 1.43.3.10861 | 1.43.3.10861 or later |
| SiteGuard Server Edition (Apache httpd, Nginx, IIS; not FreeBSD) | CVE-2026-106931 | 2.20 and later, before 8.00 Update 5 (IIS 3.10 through 4.00 Update 4 not affected, per JPCERT/CC) | 8.00 Update 5 or later, or vendor patch |
| SiteGuard Server Edition (Apache httpd, Nginx on FreeBSD) | CVE-2026-106931 | 2.20 and later, before 7.00 Update 6 | 7.00 Update 6 or later, or vendor patch |
| Siemens Software Center | CVE-2026-110936 | Before 4.0.9.8 (3.5.8.7 was the version abused) | 4.0.9.8 or later |
Two of this week’s six KEV entries, SiteGuard CVE-2026-106931 and Plex CVE-2026-96656, carry CISA’s forensic triage flag, and both are due today. For federal agencies, that means the required action points to forensics triage requirements alongside the patch, not the patch alone. Private-sector teams should borrow the habit. On SiteGuard, the vendor itself says an upgrade can erase the traces you need.
Threat Intelligence Breakdown
Plex2Shell: Attribution is unknown. According to The Hacker News, citing a separate researcher’s report, attackers fetched a miner payload with a shell script and also dropped a Linux proxy backdoor. How many servers were hit has not been reported. Reddit users have described “mylovelyminer” infections, but whether those trace to this chain is unclear.
SiteGuard: The vendor and JPCERT/CC confirm exploitation. Attackers, victims, scale and initial access have not been disclosed, and no IoCs were published in the reporting we read.
Siemens Software Center: Siemens ties the activity to Romulus, a ClickFix delivery platform. Forescout has said Romulus may be a privately run panel, a commercial service, an affiliate framework or copied software, so “Romulus” names infrastructure, not a confirmed actor. According to The Hacker News, citing Huntress, some lures came through malicious ChatGPT Custom GPTs that pointed victims to a fake site. Victims pasted a PowerShell command that installed an MSI, which then sideloaded a remote access trojan. Siemens says its own systems and update channels were not breached.
Indicators of compromise (defanged):
| Type | Indicator | Context |
|---|---|---|
| IP address | 96.62.218[.]59 | Siemens/Romulus: payload hosting and C2 (Siemens alert, via The Hacker News and SOC Prime) |
| Domain | wizardexpensive[.]com | Siemens/Romulus: payload hosting and C2 |
| IP address | 2.27.248[.]127 | Siemens/Romulus: distributes AllMyBasic.msi |
| Process chain | msiexec.exe → AllMyBasic.msi → SiemensSoftwareCenter.exe from AppData\Local\Programs |
Sideloading pattern; also look for archive.dll beside the executable |
| IP address | 217.60.194[.]116 | Plex2Shell: payload host for miner “x12345” (The Hacker News, single-source in this run) |
| IP addresses | 91.92.40[.]202, 176.65.139[.]228, 45.194.92[.]222 | Plex2Shell: listed attacker infrastructure (single-source) |
| Domain | ota.proxystream[.]st | Plex2Shell: miner pool for “mylovelyminer” (single-source) |
| File names | x12345, myawesomeproxy, mylovelyminer | Plex2Shell payloads: miner, proxy backdoor, XMRig miner (single-source) |
How to read these: the IPs will age quickly. The Siemens process chain and the Plex payload names are the durable signals. Because the Siemens executable is genuinely signed, hash-based blocking will miss it; detect on parent process, install path and adjacent DLLs.
Enterprise Impact
Web estates in Japan and beyond: SiteGuard reportedly protects more than 1.5 million sites. A compromised host-based WAF means the web server, its credentials and the data it serves are all in reach.
Hybrid-work blind spots: A compromised Plex server on a home machine that also holds a VPN client or developer credentials is a bridge into the corporate network, even though Plex itself is not “enterprise” software.
Engineering endpoints: Siemens Software Center lives on engineering workstations. A remote access trojan there can sit one hop from operational technology tools and project files.
Audit trail: Three deadlines expire today. Record when you found each instance, when you patched and what your compromise checks showed.
What Security Leaders Should Do Next
Today
- Inventory SiteGuard Server Edition on every Apache, Nginx and IIS host. Download diagnostic information before touching it, then upgrade or apply the vendor patch, or disable the statistics function as a stopgap.
- Find every Plex Media Server you can see, including on lab and developer machines, and upgrade to 1.43.3.10861 or later. Block Plex ports at the perimeter if a server can’t be updated today.
- Block the network IoCs above at the firewall, proxy and DNS layers.
Within 48 hours
- Hunt the Siemens sideloading chain in EDR:
SiemensSoftwareCenter.exestarted bymsiexec.exeor running fromAppData\Local\Programs, with unexpected DLLs alongside. - Update Siemens Software Center to 4.0.9.8 or later and confirm the version on each endpoint rather than trusting the auto-update.
- Check patched Plex hosts for the miner and proxy payloads. Anything found means rebuild and rotate credentials stored on that machine.
Long-term
- Bring security tools into the patch program. WAFs, gateways and scanners need the same owner and emergency window as the systems they protect.
- Write a policy for consumer server software on corporate and BYOD devices, and make it discoverable by your asset inventory.
- Train staff on ClickFix lures, including ones served through AI chatbots, and restrict the ability of users to paste and run PowerShell.
Get zero-day alerts before they hit the headlines
DataWater’s executive threat briefing: the exploited CVEs, the deadlines and the first three actions to take.
Winners and Losers
| Better positioned | More exposed |
|---|---|
| Plex owners who took the August update | Servers left on old builds after the October 16 write-up |
| SiteGuard teams that saved diagnostics before patching | Teams that patched first and lost the evidence |
| EDR programs that detect on process behavior | Allow-lists that trust any signed binary |
| Organizations with inventory of shadow and home-lab servers | Hybrid workforces with no visibility into personal media servers |
Final Executive Takeaway
This week’s KEV list is about the software nobody owns.
A media server, a WAF plug-in and a software updater rarely appear on a CISO’s dashboard. All three are now on CISA’s exploited list, and three of the six deadlines are today.
Inventory them, save the evidence, patch, then hunt.
Frequently Asked Questions
Which CVEs did CISA add to the KEV catalog the week ending October 23, 2026?
CISA added six CVEs to its Known Exploited Vulnerabilities catalog on October 20, 2026: Plex Media Server CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656; SiteGuard Server Edition CVE-2026-106931; and Siemens Software Center CVE-2026-110936. The catalog data we reviewed showed no other additions from October 17 to October 23.
Which CISA KEV deadlines fall on October 23, 2026?
Three KEV deadlines fall on October 23, 2026: SiteGuard Server Edition CVE-2026-106931, Plex Media Server CVE-2026-96656 and Plex Media Server CVE-2026-96654. The remaining three from this week, Plex CVE-2026-96652, Plex CVE-2026-96655 and Siemens CVE-2026-110936, are due November 3, 2026.
What version of Plex Media Server fixes Plex2Shell?
Plex Media Server 1.43.3.10861 or later fixes all four Plex2Shell flaws, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. Reports put its release in early August 2026, but exploitation only began after technical details were published on October 16.
How do I fix SiteGuard CVE-2026-106931?
Upgrade SiteGuard Server Edition to 8.00 Update 5 or later (Apache httpd, Nginx, IIS) or 7.00 Update 6 or later on FreeBSD, or apply EG Secure Solutions’ standalone patch, which also covers end-of-life versions. Download the diagnostic information first, because the vendor says patching can erase traces of a CVE-2026-106931 attack.
Is Siemens Software Center CVE-2026-110936 an industrial control system flaw?
No. Siemens Software Center CVE-2026-110936 is a DLL search-path flaw in a Windows desktop app used to download and update Siemens software. Attackers in the Romulus ClickFix campaigns bundle the genuine signed executable with a malicious DLL to run malware. Siemens says its own systems and update channels were not breached. Update to 4.0.9.8 or later.
Who is exploiting this week’s CISA KEV vulnerabilities?
No named threat actor has been tied to Plex2Shell or SiteGuard CVE-2026-106931. Siemens links CVE-2026-110936 exploitation to the Romulus ClickFix delivery platform, which Forescout says could be a private panel, a commercial service, an affiliate framework or copied software. CISA lists ransomware use as unknown for all six.
Are there indicators of compromise for Plex2Shell and Siemens CVE-2026-110936?
Yes. For Siemens CVE-2026-110936, Siemens lists 96.62.218[.]59, wizardexpensive[.]com and 2.27.248[.]127, plus SiemensSoftwareCenter.exe launched by msiexec.exe from AppData\Local\Programs. For Plex2Shell, one report lists payload host 217.60.194[.]116, the miner pool ota.proxystream[.]st and the files x12345, myawesomeproxy and mylovelyminer.
Sources
Primary sources: CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.21, via CISA’s official kev-data mirror). Reporting reviewed: BleepingComputer on Plex2Shell; BleepingComputer on SiteGuard; The Hacker News on the KEV additions; The Hacker News on Plex2Shell exploitation; The Hacker News on Siemens Software Center; eSecurity Planet on SiteGuard; SOC Prime summary of Siemens SSA-580366. Single-source claims are labeled. Reflects public reporting as of October 23, 2026.
