The United States Cybersecurity and Infrastructure Security Agency has added vulnerabilities in Plex Media Server, grouped under the name Plex2Shell, to its Known Exploited Vulnerabilities catalogue, meaning exploitation has been confirmed as active. The additions were made on 20 October 2026, alongside flaws in Siemens Software Center and SiteGuard Server Edition, with tight remediation deadlines for United States federal agencies.

The Plex2Shell chain

Four Plex vulnerabilities are grouped under the Plex2Shell name: CVE-2026-96652, a server-side request forgery flaw rated 5.3; CVE-2026-96654, rated 6.9; CVE-2026-96655, another server-side request forgery flaw rated 5.3; and CVE-2026-96656, rated 8.6, involving external control of a file name or path. Chained together, such flaws can give attackers a route into a media server that may hold personal media libraries and network access. Fixes are included in Plex Media Server version 1.43.3.10861, released on 3 August 2026.

Why the KEV list matters beyond government

CISA's deadlines bind United States federal civilian agencies, which were given until 23 October and 3 November 2026 for the various entries, but the catalogue is widely used elsewhere as a short answer to what to patch first. Inclusion in KEV means CISA has evidence attackers are using the flaw, not merely that a flaw exists. Home users running Plex should check they are on a fixed version, and organisations should treat KEV additions as urgent.

The wider October picture

October has been a busy month for the catalogue, with earlier additions covering FortiMail, Zammad, Palo Alto PAN-OS, Cisco Secure Email, AhsayCBS, BeyondTrust and SiteGuard. The pattern is a reminder to patch internet-facing services promptly rather than waiting for a convenient maintenance window. Sources: CyberSecureFox; Cybersecurity ASEAN.