CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
At a glance
- Severity
- MediumCVSS 4.3
- Used in attacks
- Yes, 1 of 1 flaw named
- Flaws named
- CVE-2026-96652
- Industries
- Government
- Reported by
- 1 outlet
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that's collectively called Plex2Shell. The vulnerabilities are listed below - CVE-2026-96652 (CVSS score: 5.3) - Plex Media Server Server-Side Request Forgery (SSRF)
We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.
Vulnerabilities referenced
- CVE-2026-966524.3Medium
Plex Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
Used in attacksAdded to CISA's list 2026-10-20
Full record →
Fastnexa security experts
This story involves a flaw attackers are already using. Are you exposed?
A Fastnexa penetration tester can check whether CVE-2026-96652 or anything like it can be used against your websites, apps and network.
Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →
Coverage
One outlet has carried this so far.
2026-10-21 07:26 UTC
Related stories
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
The Hacker News · 2026-10-22
- PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
The Register · 2026-10-21
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
The Hacker News · 2026-10-21
- CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
BleepingComputer · 2026-10-21
- Oracle Corporation security advisory (AV26-1071)
Canadian Centre for Cyber Security · 2026-10-21