Exploited CVEs Oct 19-25: Plex, Arista, Siemens, SiteGuard

Eight CVEs from five vendors entered the CISA KEV catalog between October 19 and 25, 2026, according to VulnTracker, and they have little in common beyond being exploited. Four Plex Media Server flaws chain into remote code execution, a Siemens Software Center DLL bug is being used in ClickFix attacks, a SiteGuard WAF command injection has a vendor warning about erased evidence, and the Arista VeloCloud and Collabora flaws arrived on Friday. Scores run from 4.3 to 9.9, and the federal due dates are spread across October 23, October 26 and November 3. The week also carried the PHP2Shell patches and a second PHP warning, which sit outside the KEV rows we reviewed but took up many teams' week.

Plex2Shell: four modest scores that add up to remote code execution

CISA added four Plex Media Server CVEs on Tuesday, October 20: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. A researcher, Zach Main, reported them to Plex on July 27, and Plex shipped a fixed build, 1.43.3.10861, in early August. The CVEs were published on September 23, the full technical write-up under the name Plex2Shell followed on October 16, exploitation was reported from October 17, and on October 19 Plex said the flaws were being actively and widely exploited. Sources disagree on two details: the fixed build is dated August 3 by THN and August 4 by BleepingComputer, and the public proof of concept appeared on October 16 or October 19 depending on the outlet.

Alone, none of the four looks dramatic. VulnTracker scores them 4.3, 6.5, 4.3 and 7.2. Chained, they give an unauthenticated attacker code execution as the Plex server process, and the researcher scores the full chain 9.8. In the order THN describes, an unauthenticated SSRF in the player timeline endpoint (CVE-2026-96652) reaches internal functions, a URL injection in the searchOne endpoint (CVE-2026-96654) calls other plugins' functions and returns the owner's admin token, a second SSRF in the transcoder path (CVE-2026-96655) fetches an attacker-hosted video carrying an ELF payload, and an arbitrary file write (CVE-2026-96656) places a shared object in the Codecs directory, where Plex loads it.

The reported attacks drop a Monero miner, an XMRig process named mylovelyminer, and a proxy backdoor named myawesomeproxy, pulled from 217.60.194.116. The proxy prints a notice that running it allows external use of the device's internet traffic. Source IPs reported are 91.92.40.202, 176.65.139.228 and 45.194.92.222, and the related domains sit under proxystream[.]st. No actor has been named and no count of compromised servers has been published. Affected is Plex Media Server before 1.43.3.10861.

VulnTracker's due dates match THN's split, not the single October 23 date BleepingComputer gives: October 23 for CVE-2026-96654 and CVE-2026-96656, and November 3 for CVE-2026-96652 and CVE-2026-96655. One build fixes all four, so the split changes nothing in practice.

Siemens Software Center and SiteGuard: two local-vector bugs, both exploited

Siemens published advisory SSA-580366 on October 15 for CVE-2026-110936, an uncontrolled search path flaw (CWE-427) in Software Center versions before V4.0.9.8. The app loads DLLs from a location an attacker can write to. Siemens scores it 6.7 on CVSS 3.1 and 8.4 on CVSS 4.0, both with a local vector and high privileges. On October 19 Siemens said it had validated active exploitation and tied it to what it calls the Romulus ClickFix campaign. In ClickFix, a fake verification page talks the user into pasting a command into the Run box or PowerShell, so the scores' "no user interaction" hides the first step. Per SocPrime, citing THN, the command launches AllMyBasic.msi, which starts a genuine Software Center executable beside attacker DLLs such as archive.dll, and the vulnerable version loads them. Siemens says no Siemens system or update channel was breached and that the bundle circulated outside official channels.

The fix is V4.0.9.8 or later, and Siemens says existing installs update on next startup. Siemens lists 96.62.218.59 and wizardexpensive[.]com as active payload and command servers, and tells users never to paste a command from a web page into Run or PowerShell. CISA's due date is November 3.

SiteGuard Server Edition, a WAF from EG Secure Solutions that is widely used in Japan, has an OS command injection (CWE-78) in its statistics feature, which is on by default. JPCERT/CC scored it 8.5 on CVSS 4.0 with a local vector and low privileges. The vendor told contract customers on September 29 and published its alert on October 14, saying abuse had been confirmed. CISA added it on October 20 with a due date of October 23, which has already passed. No actor, victim count or indicators have been published, and the reporting does not say how attackers gain the local foothold.

The affected builds are the Apache, Nginx and IIS editions from Ver2.20 up to Ver8.00 Update 5, and the FreeBSD Apache and Nginx editions up to Ver7.00 Update 6. The vendor's advice has an unusual first step: download the diagnostic information from the management screen before patching, because updating can erase attack traces. A standalone patch exists for installs that cannot upgrade, and JPCERT/CC says disabling the statistics function prevents exposure. Some aggregator pages call this bug remote, but every CVSS vector says local.

Friday, October 23: Arista VeloCloud and Collabora

The second wave arrived three days later, with a due date of October 26 for both entries. CVE-2026-114625 is an SQL injection in on-prem VeloCloud Orchestrator, scored 9.9 on CVSS 3.1 and 9.4 on CVSS 4.0, that lets any authenticated user, even the lowest built-in tenant role, act as a superuser operator. Arista says it is known to be actively exploited. The fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12, and Arista has already patched hosted deployments.

CVE-2026-110447 is an unauthenticated OS command injection (CWE-78) in the richdocumentscode app that runs the built-in Collabora CODE server for Nextcloud, scored 9.2 on CVSS 4.0. It works while the built-in server is not running, such as during a restart, and disabling the app does not remove the risk. Attacks were logged from September 10, and the fix is version 26.4.303 or removing the app. We cover both in detail, with log indicators and the hunt steps, in a separate post on these two CVEs.

PHP2Shell and Plex2Shell: a shared suffix, not a shared bug

PHP2Shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, patched on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both come from PHP leaving memory corrupted when a request ends abnormally, both are unauthenticated remote code execution paths, and PHP published minimal backports for 7.4, 8.0 and 8.1. IT-Connect reports a CVSS 4.0 score of 9.2 for both and says other sources gave 10.0.

Exploitation attempts started before the patches. Amazon's honeypots logged one on October 17, four days before disclosure, and Cloudflare reports attempts rising from tens of thousands within 45 minutes of the October 21 disclosure to millions by early October 22. Reports on success are mixed. Amazon describes broad attempts, while Dataminr saw scanning and exploits that did not work, with no known compromises. On October 23 PHP added CVE-2026-115560, a narrower session upload progress issue it is fixing in its next regular release, and setting session.upload_progress.enabled=0 covers it.

None of the reporting we read says CISA has added the PHP2Shell CVEs to KEV, so they stay outside the eight above. Despite the matching name, no source links the Plex chain to the PHP bugs by technique or by actor. Plex2Shell abuses Plex's own endpoints and transcoder, and PHP2Shell is a memory bug in the language runtime. What the two share is timing and exposure: both hit internet-facing services in the same week, and both drew exploitation within days of a public write-up or disclosure. The difference is lead time. Plex had a fix out for about two months before attacks began, while PHP2Shell attempts began before PHP shipped patches.

Severity did not sort this week's list

The lowest score of the week, a 4.3 Plex SSRF, entered KEV in the same update as a 9.9, and all eight entries are marked actively exploited. What separated them was how an attacker gets in, not how the CVSS reads. A medium SSRF is the first link of a chain. A 6.7 DLL bug works because a victim is talked into pasting a command. An 8.5 command injection needs a local foothold that nobody has described. The two highest scores need the least from the attacker: a tenant login in one case and nothing at all in the other.

The due dates read the same way. Five entries got three days: CVE-2026-96654, CVE-2026-96656 and CVE-2026-106931 were due October 23, and the two Friday entries from Arista and Collabora are due October 26. Three got two weeks: CVE-2026-96652, CVE-2026-96655 and CVE-2026-110936, due November 3. The Plex chain carries both deadlines. If you triage by score alone, the 4.3s are the ones you would defer, and they are the first and third steps of an attack that ends in code execution.

Reading it on VulnTracker

This is how the eight records look on VulnTracker for October 19 to 25, newest KEV wave first.

CVE	Product	Score	EPSS	KEV added	Due	SSVC
CVE-2026-114625	Arista VeloCloud Orchestrator	9.9 Critical	1%	Oct 23	Oct 26	Active, Not automatable, Total
CVE-2026-110447	Collabora Online Built-in CODE	9.2 Critical	12%	Oct 23	Oct 26	Active, Automatable, Total
CVE-2026-106931	EG Secure SiteGuard Server Edition	8.5 High	3%	Oct 20	Oct 23	Active, Not automatable, Total
CVE-2026-96656	Plex Media Server, file write	7.2 High	2%	Oct 20	Oct 23	No known exploit, Not automatable, Total
CVE-2026-110936	Siemens Software Center	6.7 Medium	1.0%	Oct 20	Nov 3	Active, Not automatable, Total
CVE-2026-96654	Plex Media Server, URL injection	6.5 Medium	2%	Oct 20	Oct 23	No known exploit, Automatable, Partial
CVE-2026-96655	Plex Media Server, SSRF	4.3 Medium	2%	Oct 20	Nov 3	No known exploit, Not automatable, Partial
CVE-2026-96652	Plex Media Server, SSRF	4.3 Medium	2%	Oct 20	Nov 3	No known exploit, Not automatable, Partial

Two things stand out. The four Plex rows show SSVC exploitation as "No known exploit" even though they are on KEV, so the SSVC field is behind the catalog. When the two disagree, go by KEV. And the scores on VulnTracker are lower than some outlets quote: THN gives 5.3, 6.9, 5.3 and 8.6 for the four Plex CVEs, and Siemens publishes both 6.7 (CVSS 3.1) and 8.4 (CVSS 4.0) for its own flaw, so check which CVSS version a number comes from before you compare it.

EPSS is low for most rows, from 1% to 3%, with Collabora the exception at 12%. For fresh KEV entries that is normal, because EPSS lags exploitation. The KEV flag already tells you the attacks are happening.

What to do

Work through these in order of exposure. The October 23 deadlines have already passed, and October 26 is the next one.

Arista VeloCloud Orchestrator and Collabora CODE. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12 for Arista, and to richdocumentscode 26.4.303 or later (or remove the app) for Nextcloud. The separate post lists the log checks and the files to hunt for.
Plex Media Server. Update to 1.43.3.10861 or later. If a server was reachable from the internet on an older build, follow Plex's advice and treat it as possibly compromised: check the Codecs folder for unfamiliar .so or .dll files, look for outbound connections to proxystream[.]st, rebuild from a clean install if anything looks wrong, sign out all devices and change the Plex password. Do not forward port 32400 directly.
SiteGuard Server Edition. Download the diagnostic information from the management screen first, then update to Ver8.00 Update 5 (Ver7.00 Update 6 on FreeBSD), or apply the vendor's standalone patch, or disable the statistics function. Consider a compromise investigation, as JPCERT/CC suggests.
Siemens Software Center. Update to V4.0.9.8 or later, search endpoints for SiemensSoftwareCenter.exe started by msiexec from AppData\Local\Programs, and block 96.62.218.59 and wizardexpensive[.]com. Remind users that a real verification check never asks them to paste a command.
PHP. Confirm every internet-facing server runs 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor build with the fix, and keep session.upload_progress.enabled=0 in place until PHP ships the fix for CVE-2026-115560.

Takeaway

This week's list rewards asking how an attacker reaches a bug before asking how high it scores. A 4.3 SSRF that opens a chain, a medium DLL bug paired with a fake verification page and a WAF flaw with no public indicators all ended up beside two critical scores, and CISA gave most of them three days. For each product you run, the useful question is whether it faces the internet and whether a patch is already available. Plex had one for two months before the attacks began.

To follow how these eight records change as scores, SSVC fields and affected versions fill in, keep an eye on them on VulnTracker.