All Articles

Eight KEV additions in four days plus a CVSS 10.0 GitLab RCE. Patch table with fixed versions and deadlines, root cause per flaw, and why CVSS-only prioritisation would have missed the Plex chain.

TL;DR

Between October 20 and 23, 2026, CISA added eight more flaws to the Known Exploited Vulnerabilities (KEV) catalog: four in Plex Media Server, which attackers chain into "Plex2Shell", plus flaws in Arista VeloCloud Orchestrator, Collabora Online, SiteGuard Server Edition and Siemens Software Center. GitLab also fixed a CVSS 10.0 unauthenticated RCE in self-managed instances; public reporting has not yet shown it exploited. All of these products are internet-facing or self-hosted. The Plex fix has existed since early August, yet servers were still exposed: most of the risk comes from slow patching, not new techniques.

Plex Media Server: the "Plex2Shell" chain

What happened. Researcher Zach Main showed that four Plex flaws chain into unauthenticated remote code execution. Attackers began using the chain soon after details were published; reported payloads are cryptocurrency miners and proxy malware. CISA added all four CVEs to KEV on October 20.

Technical root cause (BleepingComputer):

• CVE-2026-96652: unauthenticated SSRF in /player/timeline; makes Plex send POST requests anywhere, including its own internal APIs.
• CVE-2026-96654: URL injection in searchOne; lets an attacker call other plugins' functions with controlled parameters.
• CVE-2026-96655: authenticated SSRF in the transcoder endpoint.
• CVE-2026-96656: arbitrary file write in transcoder settings; plants a malicious shared library that Plex then loads.

Individually medium or high; the researcher scores the full chain 9.8. The SSRF steps take an attacker from no authentication to privileged functions.

Who is affected. All Plex Media Server versions before 1.43.3.10861 (fix shipped early August; sources say Aug 3 or Aug 4). Expect Plex on home-lab boxes, staff NAS devices and shadow media servers inside corporate networks.

What to do. Upgrade to 1.43.3.10861 or later. Search internal and external scans for Plex (default TCP 32400). Look for unexpected shared libraries in Plex directories, mining-level CPU use and outbound proxy traffic.

Arista VeloCloud Orchestrator (on-prem): CVE-2026-114625

What happened. Arista says this flaw is exploited in the wild; it has not named an actor or victim count, but published two linked IPs geolocated to Japan: 74.82.197[.]86 and 38.54.50[.]151. CISA added it to KEV on October 23 (deadline October 26). It is the third VCO flaw exploited since July 2026, after CVE-2026-16812 and CVE-2026-93952.

Root cause. SQL injection in the VCO web interface giving access to privileged internal functions. Requires network access and a valid session; the lowest working role is Enterprise Read Only.

What to do. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12. Restrict who can reach the VCO interface. Review read-only accounts and recent sessions and search logs for the published IPs. Treat "read-only" as a real access tier.

Collabora Online: CVE-2026-110447

What happened. Attackers used it to plant web shells on Nextcloud servers, then searched for credential stores, password-manager files and crypto wallets. KEV added October 23 (deadline October 26).

Root cause. OS command injection in the Built-in CODE Server ("richdocumentscode" app) used with Nextcloud, reachable through proxy.php when the local CODE server is not running.

What to do. Upgrade to 26.4.303 (released September). Search the web root for web shells. Assume credentials or secrets stored on the server are exposed and rotate them.

SiteGuard Server Edition: CVE-2026-106931

What happened. The vendor confirmed exploitation of a command injection flaw in this host-based WAF. KEV added October 20 (deadline October 23). No payload details published.

Root cause. OS command injection running commands as root or SYSTEM (CVSS 8.5). Affects SiteGuard Server Edition on Apache httpd, Nginx and IIS; mostly deployed in Japan.

What to do. Upgrade to 8.00 Update 5 (FreeBSD with Apache/Nginx: 7.00 Update 6 or later). Check WAF hosts for compromise; a compromised WAF runs with the highest privileges on the server it protects.

Siemens Software Center: CVE-2026-110936

What happened. On October 19 Siemens warned the flaw was exploited in ClickFix campaigns tied to Romulus, a ClickFix delivery platform analysed by Forescout. KEV added October 20 (deadline November 3).

Root cause. Uncontrolled search path element enabling DLL side-loading: the signed Siemens binary loads an attacker-supplied DLL (CVSS 8.4).

What to do. Upgrade to 4.0.9.8 or later. Hunt for the Siemens binary loading DLLs from user-writable paths. Pair with ClickFix awareness, since the attack depends on users pasting attacker-supplied commands.

GitLab self-managed: CVE-2026-110264

What happened. GitLab released a critical patch for an unauthenticated RCE rated CVSS 10.0, its second CVSS 10.0 RCE fix this October. Not reported exploited during the review period; not in KEV.

Root cause. Integer overflow in the regular-expression compiler: a crafted regex can let an unauthenticated attacker run code under certain conditions. Reporting places the bug in Ruby's regex handling rather than GitLab's own code.

What to do. Patch now (GitLab CE/EE from 7.0 up to the fixed versions above). Plan downtime: the release includes database migrations, so single-node instances go offline while they run. Find forgotten legacy GitLab servers; they hold source code and CI secrets.

How this affects CISOs

• Patch delay is the main exposure. Plex was fixed in August and Collabora in September, but both were exploited in October, within hours of technical write-ups.
• Low scores can chain to critical. Two Plex flaws score 5.3, but chained they give unauthenticated RCE. CVSS-only prioritisation puts them at the bottom of the queue.
• Security and management products are targets. A WAF turned into root command execution; an SD-WAN orchestrator exploited three times since July.
• Unsanctioned software counts. Plex, self-hosted Nextcloud and old GitLab often sit outside the CMDB.
• Signed binaries are being abused as loaders for ClickFix payloads.

Questions to ask your team

• Do we run any of these, including on unmanaged NAS devices, labs or shadow IT? How do we know?
• How long from published exploit to patched or isolated for internet-facing apps, versus 3-day KEV deadlines?
• Does our prioritisation account for exploit chains and KEV listing, or rank by CVSS alone?
• Which management interfaces (VCO, GitLab, WAF consoles) are reachable by low-privilege or read-only accounts?
• For systems exploitable before we patched, did we hunt and rotate secrets, or only patch?
• Do we monitor signed vendor binaries loading DLLs from user-writable paths?

Sources

• BleepingComputer: Plex2Shell
• The Hacker News: Oct 20 KEV additions
• The Hacker News: VeloCloud and Collabora
• InfoWorld: GitLab critical patches
• eSecurity Planet (DE): GitLab second CVSS 10.0 RCE
• Senthorus weekly review

Discuss: Plex2Shell was exploited within hours of disclosure using bugs patched months earlier. How are you finding and governing unsanctioned self-hosted software without driving it further underground?

How fast does your team go from KEV listing to patched?

CISO Platform members are comparing patch SLAs for internet-facing and shadow-IT systems. Join to benchmark your numbers against peers and get the weekly exploited-vulnerability briefing.

Join CISO Platform (free for security leaders) →

Related on CISO Platform

• This week in threats (Oct 22–29, 2026): the full briefing
• PHP2Shell: technical analysis and CISO action plan
• LiteLLM 1.107.0 supply-chain compromise
• Storm-0940 and the ConnectWise Cloud Backup compromise
• Railway and Zeabur: when your PaaS holds everyone’s secrets
• All Breach Intelligence posts
• Peer recommendations from security leaders