Exploited This Week: Plex2Shell, Arista VeloCloud, Collabora, SiteGuard, Siemens and GitLab CVSS 10.0

CISO Platform Intelligence · Vulnerabilities & Patching · Updated Oct 29, 2026

TL;DR

Between October 20 and 23, 2026, CISA added eight more flaws to the Known Exploited Vulnerabilities (KEV) catalog: four in Plex Media Server, which attackers chain into "Plex2Shell", plus flaws in Arista VeloCloud Orchestrator, Collabora Online, SiteGuard Server Edition and Siemens Software Center. GitLab also fixed a CVSS 10.0 unauthenticated RCE in self-managed instances; public reporting has not yet shown it exploited. All of these products are internet-facing or self-hosted. The Plex fix has existed since early August, yet servers were still exposed: most of the risk comes from slow patching, not new techniques.

Product	CVE	CVSS	Exploited?	Fixed version	KEV deadline (US federal)
Plex Media Server	CVE-2026-96656	8.6	Yes (chain)	1.43.3.10861	Oct 23
Plex Media Server	CVE-2026-96654	6.9	Yes (chain)	1.43.3.10861	Oct 23
Plex Media Server	CVE-2026-96652	5.3	Yes (chain)	1.43.3.10861	Nov 3
Plex Media Server	CVE-2026-96655	5.3	Yes (chain)	1.43.3.10861	Nov 3
Arista VeloCloud Orchestrator (on-prem)	CVE-2026-114625	9.9	Yes	5.2.3.18 / 6.1.3.10 / 6.4.2.12	Oct 26
Collabora Online (Built-in CODE Server)	CVE-2026-110447	9.2	Yes	26.4.303	Oct 26
SiteGuard Server Edition	CVE-2026-106931	8.5	Yes (vendor-confirmed)	8.00 Update 5; 7.00 Update 6+ (FreeBSD)	Oct 23
Siemens Software Center	CVE-2026-110936	8.4	Yes (ClickFix)	4.0.9.8 or later	Nov 3
GitLab CE/EE (self-managed)	CVE-2026-110264	10.0	Not reported	19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13	Not in KEV

Plex Media Server: the "Plex2Shell" chain

What happened. Researcher Zach Main showed that four Plex flaws chain into unauthenticated remote code execution. Attackers began using the chain soon after details were published; reported payloads are cryptocurrency miners and proxy malware. CISA added all four CVEs to KEV on October 20.

Technical root cause (BleepingComputer):

CVE-2026-96652: unauthenticated SSRF in /player/timeline; makes Plex send POST requests anywhere, including its own internal APIs.
CVE-2026-96654: URL injection in searchOne; lets an attacker call other plugins' functions with controlled parameters.
CVE-2026-96655: authenticated SSRF in the transcoder endpoint.
CVE-2026-96656: arbitrary file write in transcoder settings; plants a malicious shared library that Plex then loads.

Individually medium or high; the researcher scores the full chain 9.8. The SSRF steps take an attacker from no authentication to privileged functions.

Who is affected. All Plex Media Server versions before 1.43.3.10861 (fix shipped early August; sources say Aug 3 or Aug 4). Expect Plex on home-lab boxes, staff NAS devices and shadow media servers inside corporate networks.

What to do. Upgrade to 1.43.3.10861 or later. Search internal and external scans for Plex (default TCP 32400). Look for unexpected shared libraries in Plex directories, mining-level CPU use and outbound proxy traffic.

Arista VeloCloud Orchestrator (on-prem): CVE-2026-114625

What happened. Arista says this flaw is exploited in the wild; it has not named an actor or victim count, but published two linked IPs geolocated to Japan: 74.82.197[.]86 and 38.54.50[.]151. CISA added it to KEV on October 23 (deadline October 26). It is the third VCO flaw exploited since July 2026, after CVE-2026-16812 and CVE-2026-93952.

Root cause. SQL injection in the VCO web interface giving access to privileged internal functions. Requires network access and a valid session; the lowest working role is Enterprise Read Only.

What to do. Upgrade to 5.2.3.18, 6.1.3.10 or 6.4.2.12. Restrict who can reach the VCO interface. Review read-only accounts and recent sessions and search logs for the published IPs. Treat "read-only" as a real access tier.

Collabora Online: CVE-2026-110447

What happened. Attackers used it to plant web shells on Nextcloud servers, then searched for credential stores, password-manager files and crypto wallets. KEV added October 23 (deadline October 26).

Root cause. OS command injection in the Built-in CODE Server ("richdocumentscode" app) used with Nextcloud, reachable through proxy.php when the local CODE server is not running.

What to do. Upgrade to 26.4.303 (released September). Search the web root for web shells. Assume credentials or secrets stored on the server are exposed and rotate them.

SiteGuard Server Edition: CVE-2026-106931

What happened. The vendor confirmed exploitation of a command injection flaw in this host-based WAF. KEV added October 20 (deadline October 23). No payload details published.

Root cause. OS command injection running commands as root or SYSTEM (CVSS 8.5). Affects SiteGuard Server Edition on Apache httpd, Nginx and IIS; mostly deployed in Japan.

What to do. Upgrade to 8.00 Update 5 (FreeBSD with Apache/Nginx: 7.00 Update 6 or later). Check WAF hosts for compromise; a compromised WAF runs with the highest privileges on the server it protects.

Siemens Software Center: CVE-2026-110936

What happened. On October 19 Siemens warned the flaw was exploited in ClickFix campaigns tied to Romulus, a ClickFix delivery platform analysed by Forescout. KEV added October 20 (deadline November 3).

Root cause. Uncontrolled search path element enabling DLL side-loading: the signed Siemens binary loads an attacker-supplied DLL (CVSS 8.4).

What to do. Upgrade to 4.0.9.8 or later. Hunt for the Siemens binary loading DLLs from user-writable paths. Pair with ClickFix awareness, since the attack depends on users pasting attacker-supplied commands.

GitLab self-managed: CVE-2026-110264

What happened. GitLab released a critical patch for an unauthenticated RCE rated CVSS 10.0, its second CVSS 10.0 RCE fix this October. Not reported exploited during the review period; not in KEV.

Root cause. Integer overflow in the regular-expression compiler: a crafted regex can let an unauthenticated attacker run code under certain conditions. Reporting places the bug in Ruby's regex handling rather than GitLab's own code.

What to do. Patch now (GitLab CE/EE from 7.0 up to the fixed versions above). Plan downtime: the release includes database migrations, so single-node instances go offline while they run. Find forgotten legacy GitLab servers; they hold source code and CI secrets.

How this affects CISOs

Patch delay is the main exposure. Plex was fixed in August and Collabora in September, but both were exploited in October, within hours of technical write-ups.
Low scores can chain to critical. Two Plex flaws score 5.3, but chained they give unauthenticated RCE. CVSS-only prioritisation puts them at the bottom of the queue.
Security and management products are targets. A WAF turned into root command execution; an SD-WAN orchestrator exploited three times since July.
Unsanctioned software counts. Plex, self-hosted Nextcloud and old GitLab often sit outside the CMDB.
Signed binaries are being abused as loaders for ClickFix payloads.

Questions to ask your team

Do we run any of these, including on unmanaged NAS devices, labs or shadow IT? How do we know?
How long from published exploit to patched or isolated for internet-facing apps, versus 3-day KEV deadlines?
Does our prioritisation account for exploit chains and KEV listing, or rank by CVSS alone?
Which management interfaces (VCO, GitLab, WAF consoles) are reachable by low-privilege or read-only accounts?
For systems exploitable before we patched, did we hunt and rotate secrets, or only patch?
Do we monitor signed vendor binaries loading DLLs from user-writable paths?

Sources

Discuss: Plex2Shell was exploited within hours of disclosure using bugs patched months earlier. How are you finding and governing unsanctioned self-hosted software without driving it further underground?

How fast does your team go from KEV listing to patched?

CISO Platform members are comparing patch SLAs for internet-facing and shadow-IT systems. Join to benchmark your numbers against peers and get the weekly exploited-vulnerability briefing.

Join CISO Platform (free for security leaders) →

All Articles