CISA Warns Attackers Are Exploiting Plex Media Server Flaws in Plex2Shell Attacks

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four flaws in Plex Media Server that are collectively called Plex2Shell. The Hacker News reported the Tuesday addition also covered Siemens and SiteGuard flaws, and that federal agencies are ordered to patch them. It listed one of the Plex flaws, CVE-2026-96652, a server-side request forgery (SSRF) issue with a CVSS score of 5.3. BleepingComputer reported that CISA warns attackers are actively exploiting the four Plex Media Server vulnerabilities, chaining them in Plex2Shell attacks to breach servers. The excerpts available to us are truncated, so the full list of affected products and flaws is not covered here.

Timeline

1. The Hacker News

   21 Oct 2026, 07:26 UTCSource ↗

   Reports that CISA added vulnerabilities on Tuesday to its KEV catalog, including four Plex Media Server flaws called Plex2Shell and flaws in Siemens and SiteGuard products, and that federal agencies are ordered to patch them.

2. BleepingComputer

   21 Oct 2026, 18:34 UTCSource ↗

   Reports that CISA is warning attackers are actively exploiting four Plex Media Server vulnerabilities, chaining them in Plex2Shell attacks to breach servers.