CISA KEV additions October 20, 2026; federal remediation due November 3, 2026; Plex fix in version 1.43.3.10861
Three KEV Clocks Run Out Today: A Siemens DLL Flaw and Two Plex SSRF Flaws Are Due November 3
Three entries in the CISA Known Exploited Vulnerabilities catalog reach their federal remediation deadline today, November 3. The first is CVE-2026-110936 in Siemens Software Center, affecting all versions before V4.0.9.8: the application loads dynamic-link libraries from an uncontrolled search path (CWE-427), so an authenticated local attacker who can place a crafted DLL in a searched directory gets code execution with the privileges of the application. The CVE record rates it 6.7 under CVSS v3.1, Siemens published an active exploitation notice on October 19, and CISA added it to the catalog on October 20 under BOD 26-04, with forensics triage requirements attached. The other two are Plex Media Server server-side request forgery flaws from the Plex2Shell set: CVE-2026-96652, rated 5.3 in the National Vulnerability Database, lets an attacker present any X-Plex-Token value and put a full URL in the protocol parameter of the /player/timeline endpoint, forcing the server to POST to a chosen destination; CVE-2026-96655 is the second SSRF flaw, working through the transcoder path parameter. Read alone the Plex flaws look minor, but chained with the two set members whose deadlines passed on October 23, they form an unauthenticated path to code execution that the discovering researcher rates at 9.8 at chain level. One build, Plex Media Server 1.43.3.10861, fixes all five disclosed flaws. Exploitation moved fast: a honeypot caught the first in-the-wild hit within 24 hours of the October 16 public write-up, dropping the XMRig miner and a residential proxy tool, and Plex confirmed on October 19 that the flaws were being actively and widely exploited. Patching closes the door but does not remove an existing infection.
Executives
Two of today's three deadlines sit in products many boards have never heard of, and that is the point of the KEV catalog: it lists what attackers are already using, not what scores highest on paper. The Siemens tool installs and updates licensed engineering software, and the Plex chain turns a home and small-office media server into code execution. Ask for evidence of closure by build number today: V4.0.9.8 or later for Software Center, and 1.43.3.10861 or later for every Plex server, including the ones staff run at home against company media or data.
CIO / CISO
Close all three as one record, because the fixes are single builds in each product. For Plex, patching is not cleanup: check the Codecs directory for unfamiliar shared library files, look for XMRig or proxy processes, and rotate the server owner token, since stealing that token is the chain's purpose. For Siemens, apply the BOD 26-04 forensics triage the catalog attaches to this entry before you call it closed, and restrict who can write to the directories Software Center searches. Note the fifth Plex flaw, CVE-2026-96651, never entered the catalog; the same build fixes it, so its absence from KEV is no reason to leave any server behind.
Engineers
Verify versions from the products themselves, not from ticket status: Software Center at V4.0.9.8 or later, Plex at 1.43.3.10861 or later. On Plex hosts, inspect the Codecs folder for unsigned or unfamiliar .so files and review process lists before and after the update. If a Plex server does not need to be reachable from the open internet, put it behind a VPN or an authenticating reverse proxy today rather than waiting for the next chain.
Everyone (non-IT)
If you run Plex at home, update it today: open Plex, check the version under Settings, General, and install anything newer than 1.43.3.10861 if you are below it. Attackers are using these flaws to install coin miners and proxy software on other people's servers, and an update takes minutes. If your server was reachable from the internet on an old version, changing your Plex password afterward is a sensible precaution.