CISA KEV Alert: Plex Media Server, SiteGuard, and Siemens Software Center Exploited — Detection and Remediation Guide

On October 20, 2026, CISA added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation in the wild. Four of the six affect Plex Media Server — a product that runs on home networks, small business NAS devices, and, whether your asset inventory reflects it or not, almost certainly somewhere in your enterprise environment. The remaining two affect EG Secure Solutions SiteGuard Server Edition (OS command injection) and Siemens Software Center (uncontrolled search path element / DLL search-order hijacking).

A KEV listing is not a theoretical warning. It means CISA has credible evidence that adversaries are exploiting these flaws right now. Under Binding Operational Directive 22-01, federal civilian agencies have a mandated remediation deadline — but the directive's logic applies to everyone: if a vulnerability is being exploited in the wild and it's in your environment, it is an incident waiting to be discovered, not a risk to be scheduled.

This post breaks down each vulnerability, provides hunt logic you can deploy today, and gives you a remediation path for each affected product.

Technical Analysis

Plex Media Server — Four CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656)

A cluster of four vulnerabilities in Plex Media Server is the headline of this KEV addition. Plex is attractive to attackers for a simple reason: it's a long-running, often internet-exposed service that runs with the privileges of a user account (or SYSTEM/root in many NAS and service installs), has legitimate reasons to make network requests (fetching metadata, relay connections), and sits inside networks that defenders rarely monitor closely.

CVE-2026-96652 and CVE-2026-96655 — Server-Side Request Forgery (SSRF): SSRF flaws in Plex are particularly dangerous because of where Plex sits. An attacker who can coerce the Plex process into making arbitrary HTTP(S) requests gains a pivot point into internal network segments, cloud metadata endpoints (169.254.169.254), and services that trust localhost or RFC1918 sources. In practice, we've seen SSRF in media-server-type applications used for internal port scanning, credential theft from instance metadata services, and reaching management interfaces that were never intended to be reachable from a DMZ or edge segment.

CVE-2026-96654 — Improper Neutralization of Encoded URI Schemes in a Web Page: This class of flaw typically enables an attacker to inject crafted URI schemes (e.g., file://, custom protocol handlers) that survive encoding/validation logic. In a web UI context, this can be leveraged for local file access, redirect chains into internal resources, or as a delivery component chained with the SSRF and path traversal issues below.

CVE-2026-96656 — External Control of File Name or Path (Path Traversal): Attacker-controlled file paths in a media server open the door to arbitrary file read/write depending on the affected component. Combined with SSRF, a realistic chain is: SSRF to reach an internal listener → path traversal to read configuration or credential material → persistence or lateral movement. Plex stores tokens, library configurations, and in some deployments, credentials for network shares — all of which are valuable.

Exploitation status: Confirmed active exploitation per CISA KEV. At time of writing, consult the Plex security advisories (https://forums.plex.tv/c/announcements-security/) and the NVD entries for affected version ranges and CVSS scoring — verify against your installed build, as Plex ships on Windows, Linux, macOS, FreeBSD, and embedded NAS platforms (QNAP, Synology, NETGEAR ReadyNAS, Docker images), each with its own update cadence.

CVE-2026-106931 — EG Secure Solutions SiteGuard Server Edition: OS Command Injection

SiteGuard Server Edition is a web server security/WAF-type product predominantly deployed in Japanese enterprise and hosting environments. OS command injection in a security product is a worst-case scenario: these appliances sit in-line or adjacent to web traffic, run with elevated privileges, and are frequently excluded from EDR coverage because they're treated as trusted infrastructure. An unauthenticated or low-authentication command injection on an appliance like this gives an attacker code execution at a network chokepoint — ideal for traffic interception, credential harvesting, and establishing deep persistence.

Exploitation status: Actively exploited per CISA. Given the product's deployment profile, defenders in hosting, telecom, and APAC-region enterprises should treat this as priority one.

CVE-2026-110936 — Siemens Software Center: Uncontrolled Search Path Element

Uncontrolled search path element vulnerabilities (CWE-427) allow DLL search-order hijacking: an attacker plants a malicious DLL in a directory that the application searches before the legitimate system path — typically user-writable directories, the application install folder, or the current working directory. Siemens Software Center is the update/management component distributed with Siemens industrial software (TIA Portal, WinCC, and related engineering workstations), which means the exploitation surface here is OT/ICS engineering environments. These systems are frequently years behind on patching, run legacy Windows, and bridge IT and OT networks. A DLL hijack on an engineering workstation is a foothold into the control environment.

Exploitation status: Actively exploited per CISA. Refer to the Siemens ProductCERT advisory portal (https://www.siemens.com/global/en/products/services/cert.html) for affected versions and fixed releases.

Detection & Response

The detections below target the behavior these vulnerabilities enable, since post-exploitation telemetry is what you can reliably observe today.

Sigma Rules

---
title: Plex Media Server Spawning Shell or Script Interpreter
id: 3b7e2a91-4c5d-4e8f-9a1b-6d2c8e4f7012
status: experimental
description: Detects Plex Media Server processes spawning shells, script interpreters, or system utilities — a strong post-exploitation indicator for the actively exploited Plex SSRF and path traversal CVEs (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Plex does not spawn child shells in normal operation.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Plex Media Server.exe'
      - '\PlexScriptHost.exe'
      - '\Plex Tuner Service.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare; Plex plugins or DVR post-processing scripts may invoke interpreters under controlled configurations
level: high
---
title: Plex Media Server Outbound Connection to Internal or Metadata Addresses
id: 8f1c4d62-7a3b-4e95-b2d8-5c9a1e6f3045
status: experimental
description: Detects Plex Media Server processes initiating connections to RFC1918/internal ranges, localhost services, or cloud instance metadata (169.254.169.254) — indicative of SSRF exploitation via CVE-2026-96652 or CVE-2026-96655. Tune the destination list to your environment's expected Plex integrations (e.g., known NAS/library hosts).
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/t1090/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.command_and_control
  - attack.t1090
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|contains: '\Plex Media Server.exe'
  selection_metadata:
    DestinationIp: '169.254.169.254'
  selection_loopback_svc:
    DestinationIp|startswith: '127.'
    DestinationPort:
      - 445
      - 3389
      - 5985
      - 5986
      - 22
      - 1433
      - 3306
  condition: selection_image and 1 of selection_metadata, selection_loopback_svc
falsepositives:
  - Local Plex clients streaming over loopback (typically port 32400, excluded above); DLNA integrations — baseline before deploying at medium level
level: high
---
title: DLL Loaded from User-Writable Path by Siemens Software Center
id: 5d2e9b47-1f8a-4c36-a7e4-9b3d6f0e1289
status: experimental
description: Detects Siemens Software Center components loading DLLs from user-writable or non-standard directories — consistent with uncontrolled search path exploitation (CVE-2026-110936, CWE-427 DLL search-order hijacking). Legitimate Siemens components load from Program Files or System32.
references:
  - https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/t1574/001/
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection_image:
    Image|contains:
      - '\Siemens\'
      - '\SoftwareCenter'
  selection_dll_path:
    ImageLoaded|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\ProgramData\'
      - 'C:\Temp\'
      - 'C:\Windows\Temp\'
  filter_signed_known:
    ImageLoaded|contains:
      - '\Program Files\Siemens\'
      - '\Program Files (x86)\Siemens\'
      - '\Windows\System32\'
      - '\Windows\SysWOW64\'
  condition: selection_image and selection_dll_path and not filter_signed_known
falsepositives:
  - Developer/test builds of Siemens tooling on engineering workstations; verify signer metadata on any hit
level: high

KQL — Microsoft Sentinel / Defender

This query hunts Plex post-exploitation behavior (child processes plus suspicious egress) and Siemens DLL-hijack artifacts. It assumes Defender for Endpoint tables; if you ingest Plex hosts via Syslog/CEF, adapt the second section against CommonSecurityLog.

let PlexChildren = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("Plex Media Server.exe", "PlexScriptHost.exe", "Plex Tuner Service.exe")
    or InitiatingProcessFolderPath has "Plex Media Server"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","certutil.exe","curl.exe","wget.exe","bitsadmin.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
let PlexEgress = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "Plex Media Server.exe"
| where RemoteIP == "169.254.169.254"
    or (RemoteIP startswith "127." and RemotePort in (445, 3389, 5985, 5986, 22, 1433, 3306))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl;
let SiemensHijack = DeviceImageLoadEvents
| where TimeGenerated > ago(14d)
| where FolderPath has_any ("\\Siemens\\", "SoftwareCenter")
| where FileName endswith ".dll"
    and (FolderPath has_any ("\\Users\\Public\\", "\\AppData\\", "\\Downloads\\", "\\Temp\\", "\\ProgramData\\"))
    and not (FolderPath has_any ("\\Program Files\\Siemens\\", "\\Program Files (x86)\\Siemens\\", "\\Windows\\System32\\", "\\Windows\\SysWOW64\\"))
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, SHA256;
PlexChildren
| union PlexEgress, SiemensHijack
| sort by TimeGenerated desc

For SiteGuard (CVE-2026-106931), the appliance itself typically logs via syslog. Hunt for command-injection artifacts in web request data ingested into CommonSecurityLog or a custom web-log table: look for shell metacharacters (;, |, `, $(, %3B, %7C URL-encoded equivalents) in request URIs directed at SiteGuard-managed hosts, and any unexpected outbound connections from the appliance to non-update destinations.

Velociraptor VQL

Use this artifact to triage suspected compromised Plex hosts — enumerate the Plex process tree and its live network connections in one pass.

-- Triage: Plex Media Server processes, children, and network connections
LET plex_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)plex' OR Exe =~ '(?i)Plex Media Server'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid in (SELECT Pid FROM plex_procs)
  AND Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|sh|bash|curl|wget|python|perl)'

LET plex_conns = SELECT Pid, Name, Family, Type, Laddr, Raddr, Status
FROM netstat()
WHERE Name =~ '(?i)plex'
  AND Status =~ 'ESTABLISHED'
  AND NOT Raddr =~ '^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.).*:32400'

SELECT * FROM plex_procs
UNION ALL SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime FROM suspicious_children

For Siemens engineering workstations, complement the above with a glob() sweep for unsigned DLLs planted in user-writable paths:

-- Hunt for recently written DLLs in user-writable directories on engineering workstations
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/Public/**/*.dll',
  'C:/Users/*/AppData/Local/Temp/**/*.dll',
  'C:/Users/*/Downloads/*.dll',
  'C:/Temp/**/*.dll'
])
WHERE Mtime > timestamp(epoch=now() - 1209600)
ORDER BY Mtime DESC

Verification & Hardening Script

Run the following PowerShell (elevated) on Windows hosts to inventory Plex exposure, enumerate Siemens Software Center presence, and pull process lineage evidence for review. This does not patch — it establishes scope so you can patch intelligently.

# KEV triage: Plex, Siemens Software Center inventory + containment prep
$report = @()

# 1. Plex Media Server presence, version, and exposure
$plex = Get-ItemProperty 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*',
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -match 'Plex Media Server' }
if ($plex) {
    $report += [pscustomobject]@{Product='Plex Media Server'; Version=$plex.DisplayVersion; Path=$plex.InstallLocation; Risk='KEV: CVE-2026-96652/96654/96655/96656 - patch immediately'}
    # Is Plex listening on non-default interfaces?
    Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
      Where-Object { $_.OwningProcess -in (Get-Process -Name 'Plex Media Server' -ErrorAction SilentlyContinue).Id } |
      Select-Object LocalAddress, LocalPort | Format-Table -AutoSize
}

# 2. Siemens Software Center presence
$siemens = Get-ChildItem 'C:\Program Files\Siemens','C:\Program Files (x86)\Siemens' -ErrorAction SilentlyContinue
if ($siemens) { $report += [pscustomobject]@{Product='Siemens install detected'; Version='Check SCC version'; Path='C:\Program Files*\Siemens'; Risk='KEV: CVE-2026-110936 - verify Software Center version'} }

# 3. DLL hijack surface check: writable dirs on PATH
$env:Path -split ';' | ForEach-Object {
    if (Test-Path $_) {
        $acl = Get-Acl $_
        $writable = $acl.Access | Where-Object { $_.IdentityReference -match 'Users|Everyone|Authenticated Users' -and $_.FileSystemRights -match 'Write|Modify|FullControl' }
        if ($writable) { Write-Warning "Writable PATH directory (DLL hijack risk): $_" }
    }
}

# 4. Temporary containment: block Plex egress to metadata + localhost admin ports pending patch
New-NetFirewallRule -DisplayName 'KEV-Triage: Block Plex to cloud metadata' -Direction Outbound -Program "$($plex.InstallLocation)Plex Media Server.exe" -RemoteAddress 169.254.169.254 -Action Block -ErrorAction SilentlyContinue

$report | Format-Table -AutoSize
Write-Host "`nTriage complete. Cross-reference versions against vendor advisories and patch within CISA KEV SLA." -ForegroundColor Cyan

Remediation

1. Confirm scope first. Query your asset inventory and EDR for Plex Media Server across all platforms — including NAS devices (QNAP/Synology package center installs), Docker containers, and macOS/Linux hosts that won't appear in your Windows software inventory. Shadow IT Plex instances on employee workstations and lab networks are the most common blind spot.
2. Patch Plex immediately. Update to the fixed release per the Plex security advisory for CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. On NAS platforms, update through the vendor package center — do not assume the Plex in-app updater covers embedded builds. If you cannot patch within 24 hours, take the instance offline or restrict it to localhost/LAN-only until updated.
3. Remove Plex from internet exposure. Regardless of patch state, Plex should never be directly internet-facing without a reverse proxy with authentication, or Plex's own relay with remote access tightly scoped. Block inbound 32400 at the perimeter unless there is a documented business requirement.
4. SiteGuard (CVE-2026-106931): Apply the EG Secure Solutions vendor update immediately. Because this is a command injection on a security appliance, treat unpatched exposure as a potential compromise: review appliance logs for anomalous requests containing shell metacharacters, audit outbound connections from the appliance over the exploitation window, and rotate any credentials the appliance could access.
5. Siemens Software Center (CVE-2026-110936): Update via the Siemens ProductCERT advisory guidance. On engineering workstations, audit for DLLs in user-writable directories (script above), and verify that no user-writable directory precedes system directories in the PATH. Segment OT engineering workstations from general IT egress per IEC 62443 zoning principles.
6. Meet the CISA deadline. Under BOD 22-01, FCEB agencies must remediate KEV entries by the due date listed in the catalog (typically three weeks from listing — approximately November 10, 2026 for this batch). Private-sector organizations should adopt the same SLA as their internal standard.
7. Assume breach where exposure existed. For any internet-facing Plex instance or SiteGuard appliance that was unpatched during the exploitation window, run the hunts above across at least 30 days of retained telemetry. KEV listings mean someone found these before you did.

The through-line of this KEV batch is uncomfortable but familiar: consumer-grade and niche software running inside enterprise perimeters, and trusted security/update infrastructure as the exploitation vector. Asset visibility — knowing where Plex, SiteGuard, and Siemens components actually live — is the prerequisite for everything else in this post.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub