CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws

CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including flaws affecting Plex Media Server collectively known as Plex2Shell, as well as vulnerabilities in Siemens and SiteGuard products. One of the listed vulnerabilities is CVE-2026-96652, a Server-Side Request Forgery (SSRF) flaw in Plex Media Server with a CVSS score of 5.3. Federal agencies have been ordered to patch these vulnerabilities promptly. The inclusion in the KEV catalog indicates active exploitation in the wild. The directive underscores ongoing risks to government and enterprise environments from known, unpatched vulnerabilities in widely used software and industrial control systems.