CISA Urges Federal Agencies to Patch Actively Exploited Plex2Shell and Industrial Flaws
CISA has added four new vulnerabilities to its KEV catalog, including critical flaws in Plex Media Server known as Plex2Shell. Federal agencies are mandated to patch these immediately due to active exploitation.
TL;DR
- CISA added four new vulnerabilities to its Known Exploited Vulnerabilities catalog.
- Includes Plex2Shell flaws in Plex Media Server allowing SSRF attacks.
- Other impacted systems include Siemens industrial software and SiteGuard.
- All listed flaws are under active exploitation in the wild.
- Federal agencies required to remediate by specified deadlines.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) continues to strengthen federal cybersecurity posture by mandating the immediate remediation of newly identified vulnerabilities. This latest directive targets four actively exploited flaws, including multiple in Plex Media Server collectively referred to as Plex2Shell, along with vulnerabilities in Siemens and SiteGuard products.
These vulnerabilities have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, triggering binding operational directives for federal agencies. With evidence of real-world exploitation, swift action is essential to mitigate potential risks to national infrastructure and sensitive data systems.
Plex2Shell Vulnerabilities in Focus
- CVE-2026-96652 affects Plex Media Server with a CVSS score of 5.3, enabling Server-Side Request Forgery (SSRF).
- SSRF flaws can allow attackers to bypass network restrictions and access internal services.
- The Plex2Shell vulnerability set poses risks particularly to exposed media servers.
- Organizations using Plex Media Server should verify versions and apply patches immediately.
Broader Impact and Compliance Requirements
- Inclusion in the KEV catalog means federal agencies must patch within specified timeframes.
- Siemens and SiteGuard vulnerabilities also pose significant threats to operational technology environments.
- Active exploitation signals potential widespread abuse if left unpatched.
- Non-compliance with CISA directives can lead to escalated risk and regulatory consequences.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.