CISA adds exploited SiteGuard, Plex Media Server, and Siemens flaws to its catalog with patch deadlines

CISA added six actively exploited flaws to its Known Exploited Vulnerabilities catalog. The newest is CVE-2026-106931, a command injection rated 8.5 in EG Secure Solutions SiteGuard Server Edition, a Japanese product the vendor confirmed is being exploited. CISA also added the four Plex2Shell flaws in Plex Media Server, which researchers chain for unauthenticated remote code execution and which are being used to deploy cryptocurrency miners and proxy malware, and the Siemens Software Center DLL sideloading flaw CVE-2026-110936 abused in ClickFix attacks. Federal agencies must patch SiteGuard and two Plex flaws by October 23, and the remaining ones by November 3.

Check

Check for EG Secure SiteGuard Server Edition, Plex Media Server, and Siemens Software Center, and patch them to meet the October 23 and November 3 federal deadlines.

Affected

SiteGuard Server Edition, unpatched Plex Media Server, and Siemens Software Center are all confirmed exploited, enabling command injection, unauthenticated code execution, and ClickFix-delivered malware.

Fix

Patch the affected products on the CISA timeline, prioritize internet-facing Plex and SiteGuard instances, and review hosts for miners, proxies, and sideloaded DLLs.