# CISA KEV: Exploited Plex2Shell Plex Media Server Chain (CVE-2026-96652/96654/96655/96656), Siemens Software Center CVE-2026-110936 and SiteGuard CVE-2026-106931

> CISA added the Plex Media Server 'Plex2Shell' chain (four flaws yielding unauthenticated RCE), Siemens Software Center DLL sideloading (CVE-2026-110936) and SiteGuard Server Edition command injection (CVE-2026-106931) to the KEV catalog. Attackers are exploiting the Plex chain to deploy an XMRig-based miner and a reverse-proxy backdoor, and the Siemens flaw in Romulus ClickFix campaigns delivering LegionLoader.

- **Published:** 2026-10-24T15:32:43Z
- **Last reviewed:** 2026-10-24T15:32:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4405
- **ID:** TL-2026-4405
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656, CVE-2026-110936, CVE-2026-106931

## Description

Plex2Shell is the name for four Plex Media Server vulnerabilities (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that, chained, give unauthenticated remote code execution on servers prior to 1.43.3.10861. The researcher (Zach Main) rates the chain CVSS 9.8; the individual flaws score 5.3, 6.9, 5.3 and 8.6. The chain: (1) an unauthenticated SSRF in /player/timeline, where token validation only checks that an X-Plex-Token header exists (any value, e.g. 'junk'), makes Plex send a blind POST from 127.0.0.1 using an unvalidated 'protocol' parameter (CVE-2026-96652); (2) the searchOne endpoint under /system/agents/*/searchOne splices an identifier unsanitized into a URL, so '?' and '#' characters forge calls to other plugin functions that require loopback origin (CVE-2026-96654); (3) the TheTVDB agent function GetResultFromNetwork attaches the owner's admin token (local-*) to any URL starting with 'http://127.0.0.1', which is bypassed with a hostname like http://127.0.0.1.<attacker>.sslip.io that resolves to the attacker, leaking the admin token; (4) an authenticated SSRF in /video/:/transcode/universal (CVE-2026-96655) and a prefs change (PUT /:/prefs?TranscoderH264Options=dump-yuv=<path>:qp=0) make the x264 encoder write bit-exact decoded frames of a lossless H.264 MP4 into the Codecs directory, planting an ELF shared object (CVE-2026-96656, external control of file name/path). Plex's avpriv_load_new_libs then dlopen()s every .so in the Codecs directory without signature, permission or symbol checks, so the ELF constructor (DT_INIT_ARRAY) runs.

Timeline per sources: reported to Plex 2026-07-27; fix in Plex Media Server 1.43.3.10861 (most sources say released 2026-08-03; one reports 2026-08-04 acknowledgement and a 2026-09-01 follow-up); technical write-up and PoC published around 2026-10-16 (github.com/code-zm/plex2shell); in-the-wild exploitation first observed 2026-10-17 by researcher boredhackerblog, who documented payloads: an XMRig-based miner ('mylovelyminer') pulling from the pool ota.proxystream.st and a Linux reverse-proxy backdoor ('myawesomeproxy') that displays a consent notice about internet traffic use. Payloads were fetched by shell scripts using wget or curl from 217.60.194.116. The researcher notes Plex servers often sit on residential IPs, which makes them attractive as residential proxies for reaching corporate VPNs and email.

CVE-2026-110936 (Siemens Software Center, CVSS 4.0 8.4) is an uncontrolled DLL search path flaw. Siemens confirmed exploitation in multi-platform Romulus ClickFix campaigns: a trojanized MSI (AllMyBasic.msi) and a PowerShell staging script place attacker-controlled DLLs beside a legitimate, signed copy of Siemens Software Center, which loads them. The loader is LegionLoader, which can collect Chrome browser data. Vulnerable: 3.5.8.7 and earlier; fixed in 4.0.9.8. Reported by Jose Oregon of Huntress Labs. Siemens published IOCs 96.62.218.59, wizardexpensive.com and 2.27.248.127.

CVE-2026-106931 (SiteGuard Server Edition WAF by EG Secure Solutions, CVSS 4.0 8.5 / CVSS 3.0 7.8, CWE-78) is an OS command injection in the statistics function (enabled by default) that runs commands as root (Linux/FreeBSD) or SYSTEM (Windows). Affected: Apache/Nginx/IIS 2.20 through 8.00 Update 4; Apache/Nginx on FreeBSD 2.20 through 7.00 Update 5. Fixed in 8.00 Update 5 and 7.00 Update 6. The vendor confirmed abuse and notified support customers on 2026-09-29, with public disclosure on 2026-10-18; the vendor warns patching may erase traces, so diagnostic information should be saved first. Attacker, victims and methods are undisclosed. CISA deadlines: 2026-10-23 for CVE-2026-106931, CVE-2026-96656 and CVE-2026-96654; 2026-11-03 for the rest. No threat actor attribution is stated in any source. A BeaconBeagle domain search for proxystream.st returned no C2 configs; the IP lookup endpoint returned 404 for 217.60.194.116.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1574.001 DLL
- T1528 Steal Application Access Token
- T1555.003 Credentials from Web Browsers
- T1090 Proxy
- T1496.001 Compute Hijacking

## Sources

- [CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws](https://thehackernews.com/2026/10/cisa-orders-federal-agencies-to-patch.html)
- [Hackers Exploit Plex2Shell Flaws (The Hacker News)](https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html)
- [CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers (BleepingComputer)](https://bleepingcomputer.com/news/security/cisa-hackers-chain-plex-flaws-in-plex2shell-attacks-to-breach-servers)
- [Plex2Shell exploit chain weaponized against Plex servers hours after disclosure (SecurityWeek)](https://www.securityweek.com/plex2shell-exploit-chain-weaponized-against-plex-servers-hours-after-disclosure/)
- [Plex2Shell technical write-up (Zach Main)](https://zmain.info/blog/plex2shell)
- [Plex2Shell PoC repository (code-zm)](https://github.com/code-zm/plex2shell/)
- [Plex vulnerabilities being exploited in the wild (boredhackerblog)](https://boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html)
- [Attackers exploit Siemens Software Center flaw in active ClickFix malware campaign (Help Net Security)](https://www.helpnetsecurity.com/2026/10/20/exploitation-siemens-software-center-vulnerability-cve-2026-110936/)
- [ClickFix attackers exploit Siemens Software Center (The Hacker News)](https://thehackernews.com/2026/10/clickfix-attackers-exploit-siemens.html)
- [Hackers exploit SiteGuard WAF flaw to run commands as SYSTEM/root (BleepingComputer)](https://www.bleepingcomputer.com/news/security/hackers-exploit-siteguard-waf-flaw-to-run-commands-as-system-root/)
- [CVE-2026-106931 SiteGuard WAF Flaw Exploited: Save Evidence Before Patching (eSecurity Planet)](https://www.esecurityplanet.com/vulnerabilities/news-cve-2026-106931-siteguard-waf-exploited/)
- [Plex2Shell exploit used to turn vulnerable Plex servers into crypto miners (Security Affairs)](https://securityaffairs.com/?p=201324)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4405