CISA Adds Plex2Shell, Siemens, SiteGuard to KEV

CISA updated its Known Exploited Vulnerabilities catalog on October 21 with four confirmed exploited flaws across three products: the Plex2Shell vulnerability chain in Plex Media Server, a high-severity DLL sideloading bug in Siemens Software Center, and a vulnerability in the SiteGuard web application firewall. Federal civilian agencies must remediate per Binding Operational Directive 22-01.

Here is what to do, in priority order.

Plex Media Server: patch it now

This is the active emergency. The Plex2Shell five-CVE chain (CVE-2026-96651, CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) has been under mass exploitation since October 16, one day after a public proof-of-concept circulated. Attackers are converting compromised servers into XMRig-based cryptocurrency miners and outfitting them with a Linux proxy backdoor.

The fix has been available since August 3. Patch to Plex Media Server 1.43.3.10861 or any later release. If you cannot patch immediately, restrict network access to the Plex management interface so it is not reachable from untrusted networks. That is a temporary measure, not a substitute for patching.

Siemens Software Center: DLL sideloading

Siemens confirmed and patched a high-severity DLL sideloading vulnerability in Siemens Software Center. Threat actors exploited it through ClickFix-style social engineering attacks to deploy remote access tooling. The authoritative CVE ID and advisory link are in the CISA KEV entry. Apply the Siemens-issued fix and review endpoints where Siemens Software Center is deployed for signs of unauthorized remote access tools.

SiteGuard

CISA confirmed exploitation of a vulnerability in SiteGuard. The CISA KEV entry carries the advisory link and patch guidance.

What this means for non-federal organizations

BOD 22-01 binds federal civilian agencies. For private sector and critical infrastructure organizations: a KEV addition is CISA’s public statement that a vulnerability is confirmed exploited against real targets. If any of these products are in your environment, use the federal deadline as your own.

The Plex2Shell chain especially does not need a government mandate to prioritize. Exploitation is confirmed, ongoing, and documented.

Related: Plex2Shell Exploited to Deploy Miners, Linux Backdoor / CISA: Five Flax Typhoon CVEs Added, Feds Have Until Oct 11 / Palo Alto PAN-OS Zero-Day Added to KEV, Fix by Oct 17