The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for federal agencies to address several high-risk vulnerabilities. As of Tuesday, CISA has augmented its Known Exploited Vulnerabilities (KEV) catalog with four new entries that affect Plex Media Server, collectively termed Plex2Shell.
Plex2Shell Vulnerabilities Identified
The identified vulnerabilities in Plex Media Server include CVE-2026-96652 and CVE-2026-96655, each with a CVSS score of 5.3, classified as Server-Side Request Forgery (SSRF) vulnerabilities. Another vulnerability, CVE-2026-96654, presents a higher risk with a score of 6.9 due to improper neutralization of encoded URI schemes. Additionally, CVE-2026-96656, with a score of 8.6, allows external control of file names or paths.
These vulnerabilities, revealed by security researcher Zach Main, could be exploited by remote attackers to execute unauthenticated code. The issues were reportedly resolved in Plex Media Server version 1.43.3.10861, released on August 3, 2026.
Exploitation Concerns and Response
The inclusion of these vulnerabilities in the KEV catalog follows findings by researcher boredhackerblog, who noted their exploitation by cybercriminals to install cryptocurrency miners and proxy malware. Such activity underscores the urgent need for mitigation measures.
In addition to the Plex vulnerabilities, CISA has identified two further flaws as actively exploited. One involves a DLL sideloading vulnerability in Siemens Software Center (CVE-2026-110936) with a CVSS score of 8.4, leveraged in ClickFix attacks via the Romulus platform. The other is a command injection flaw in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) with a score of 8.5, confirmed by the Japanese company to be under exploitation.
Compliance Deadlines for Federal Agencies
CISA has stipulated deadlines for the remediation of these vulnerabilities. Federal Civilian Executive Branch (FCEB) agencies are required to implement patches for CVE-2026-106931, CVE-2026-96656, and CVE-2026-96654 by October 23, 2026. The remaining vulnerabilities must be addressed by November 3, 2026.
This directive emphasizes the critical nature of cybersecurity in protecting federal infrastructure from ongoing threats. Agencies are urged to comply promptly to prevent potential exploitation and safeguard sensitive data.
